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Preface 


Risk-based ship design is a new scientific and engineering field of growing inter- 
est to researchers, engineers and professionals from various disciplines related to 
ship design, construction, operation and regulation. Applications of risk-based ap- 
proaches in the maritime industry started in the early 1960s with the introduction 
of the concept of probabilistic ship’s damage stability. In the following, they were 
widely applied within the offshore sector and are now being adapted and utilized 
within the ship technology and shipping sector. 

The main motivation to use risk-based approaches is twofold: implement a novel 
ship design which is considered safe but — for some formal reason — cannot be 
approved today and/or rationally optimise an existing design with respect to safety, 
without compromising on efficiency and performance. 

The present book derives from the knowledge gained in the course of the project 
SAFEDOR (Design, Operation and Regulation for Safety), an Integrated Project 
under the 6th framework programme of the European Commission (IP 516278). 
The topic of SAFEDOR is risk-based ship design, operation and regulation. The 
project started in February 2005 and will be completed in April 2009. Under the 
coordination of Germanischer Lloyd, 52 European organizations — representing all 
stakeholders of the maritime industry — took part in this important R&D project. 

The present book does not aim to be a textbook for postgraduate studies, as con- 
tributions to the subject topic are still evolving and some time will be necessary 
until maturity. However, as the topic of risk-based design, operation and regulation 
is almost absent from today’s universities’ curricula, the book aims to contribute to 
the necessary enhancement of academic curricula to address this important subject 
to the maritime industry. Therefore, the aim of the book is to provide the readers 
with an understanding of the fundamentals and details of the integration of risk- 
based approaches into the ship design process. The book facilitates the transfer of 
knowledge from the research conducted within the SAFEDOR project to the wider 
maritime community and nurtures inculcation upon scientific approaches dealing 
with risk-based design and ship safety. 

The book is introduced by an overview of risk-based approaches to the maritime 
industry in Chap. | by Dr. Pierre C. Sames (Germanischer Lloyd). The risk-based 
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ship design, related concepts and a passenger ship case study, presented by Pro- 
fessor Dracos Vassalos (Universities of Glasgow and Strathclyde), are following in 
Chap. 2. The risk-based maritime regulatory framework and developments of For- 
mal Safety Assessment are presented by Dr. Rolf Skjong (Det Norske Veritas) in 
Chap. 3. The risk-based approval process is outlined in Chap. 4 by Mr. Jeppe Juhl 
(Danish Maritime Authority). In Chap. 5, a variety of methods and tools to ad- 
dress critical design and operation scenarios are elaborated by Professors Jgrgen 
Jensen (Technical University of Denmark), Carlos Guedes Soares (Instituto Supe- 
rior Tecnico, Lisbon) and Apostolos Papanikolaou (National Technical University of 
Athens). Finally, in Chap. 6, three risk-based ship design case studies are elaborated, 
namely the first on the design of a lightweight composite sandwich superstructure of 
a RoPax ship by Mr. Dag McGeorge (Det Norske Veritas), the second on the design 
of an AFRAMAX oil tanker by Professor Apostolos Papanikolaou (National Tech- 
nical University of Athens) and the third on the design of a fast RoPax vessel by 
Dr. Andrzej Jasionowski (Safety at Sea, Glasgow) and Mr. Esa Péylié (Deltamarin, 
Finland). 

The target readership of this book is engineers and professionals in the maritime 
industry, researchers and post-graduate students of naval architecture, marine engi- 
neering and maritime transport university programs. The book closes a gap in the 
international literature, as no other books are known in the subject field covering 
comprehensively today the complex subject of risk-based ship design. 

The complexity and the evolving character of the subject required the contribu- 
tion from many experts active in the field. As editor of this book, I am indebted to the 
authors of the various book chapters reflecting their long time research in the field. 
Also, the contributions of the whole SAFEDOR partnership to the presented work 
and the funding by the European Commission (DG Research) are acknowledged. 
Finally, the support of Dr. Eleftheria Eliopoulou (National Technical University of 
Athens) in the edition of the book is acknowledged. 


Athens, Greece Apostolos Papanikolaou 
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Chapter 1 


Introduction to Risk-Based Approaches 
in the Maritime Industry 


Pierre C. Sames 


Abstract Methods of risk and reliability analysis gain more and more acceptance 
as decision support tools in engineering applications. Integration of these methods 
into the design process leads to risk-based design. Ship safety is well regulated at 
United Nations’ level by the International Maritime Organization (IMO) and a ten- 
dency to move from prescriptive to goal-based regulations is seen today. In parallel, 
advances in technology and the need to develop ever more economic maritime so- 
lutions drives innovation and risk analysis is becoming a central element for the 
development of novel ships. Therefore, an enhanced ship design process integrating 
risk analysis was conceived over the last decade and appropriate additions to the reg- 
ulatory framework were recently developed. Today, all main elements of risk-based 
ship design and approval are being developed and early applications demonstrate 
their feasibility in practice. 


1.1 The Need for Risk-Based Design 


1.1.1 Societal Expectations and Economic Attractions 


Sustainable development related to the welfare and safety of people and to conser- 
vation of the environment have been the subject of increasing concern to society 
during the last decades. At the same time, optimal allocations of available natural 
and financial resources are considered very important. Therefore, methods of risk 
and reliability analysis in various engineering disciplines, developed during the last 
decades, are becoming more and more important as decision support tools in en- 
gineering applications. Integration of risk and reliability analysis methods into the 
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design process leads to “risk-based design”. As applied to the design of ships, risk- 
based design and approval was introduced by Bainbridge et al. (2004) and is the 
focus of this book. 

Innovation in the transportation industry (aerospace, automotive and rail indus- 
try) has to a large extent been driven by safety. As an example of the automotive in- 
dustry, crash-performance tests of independent authorities have shown to customers 
that large vehicles with integrated crash energy dissipating elements, airbags for 
side or frontal impact protection etc. provide increased safety in accidents. On the 
other hand, ship safety is well regulated at United Nations’ level by the International 
Maritime Organization (IMO) instead of relying on individual manufacturers’ or na- 
tional administrations’ responsibility for safety. However, the development of mar- 
itime safety regulations has until recently been driven mainly by individual events 
instead of a pro-active and holistic approach. Every major catastrophic accident, in 
particular those in the industrialized world, has led to a new safety regulation and 
subsequent design measures imposed by the IMO and the classification societies. 
Today however, a clear tendency to move from prescriptive to goal-based regula- 
tions is emerging. 

Changes in scientific and technological developments at an ever increasing pace 
and an overall better technical capability at a much larger scale are fuelling in- 
novation in the shipping sector to meet the demand for larger, more complex and 
specialized ships. This is taking place in an environment that is still fragmented, un- 
dermanned and intensively competitive, while society is more demanding on issues 
related to human safety and the protection of the environment. Safety could easily 
be undermined and the consequences could be disastrous. Therefore, the way safety 
is being dealt with is changing and with the adoption of holistic and risk-based ap- 
proaches to maritime safety, balancing the elements affecting safety cost-effectively 
and throughout the life cycle of the vessel, safety will be dealt with as a key aspect 
with serious economic implications rather than a simplistic add-on in the design 
process seeking compliance with prescriptive regulations. 

Fuelled by expected continuous growth of maritime transport and the need to 
provide sustainable shipping, economic opportunities drive proposals for ever more 
innovative ships and shipping concepts. Recent examples include cruise ships with 
huge shopping malls inside the superstructure and compressed natural gas trans- 
porters. With risk-based approaches firmly established in the maritime industry, ship 
owners will be able to implement those innovative ships and maritime transport so- 
lutions which (partly) cannot be approved today because of the current rules and reg- 
ulations’ prescriptive limitations. Shipyards and equipment manufacturers will also 
benefit from the introduction of risk-based approaches through enabling novel and 
optimized ships and systems incorporating new functions and materials. The bene- 
fits arise from the fact that yards acquainted with risk-based approaches are among 
the first to respond to the increasing demand from ship owners for those novel ships. 
In addition, production costs may be reduced through application of risk-based ap- 
proaches when, e.g., novel systems allow for improved modularization. Although 
the recent focus of applying risk-based design was to passenger ships, examples for 
cargo ships also exist (for example, MSC 76/INF.15 and MSC 82/23/3). 
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1.1.2 An Enhanced Design Process 


Risk-based ship design introduces risk analysis into the traditional design process 
aiming to meet safety objectives cost effectively. This is facilitated by use of ad- 
vanced computational tools to quantify the risk level of a particular design and its 
variants. Risk is used to measure the safety performance. With safety becoming 
measurable, the design optimization can effectively be expanded and a new objec- 
tive — minimize risk — is addressed alongside traditional design objectives relating to 
earning potential, speed and cargo carrying capacity. It is expected that with the in- 
troduction of safety as an objective into the design optimization process rather than 
being treated as a constraint, new technical solutions will be explored: the design 
solution space becomes larger. 

Even though, deriving from the above, risk-based design is principally associated 
with introducing safety objectives explicitly in the design process; two clearly dis- 
tinct motivations for risk-based design could be identified. First, it is the realization 
of an idea for a new transport solution which challenges (possibly outdated) rules — 
meaning that the new solution cannot be approved. Risk-based design and approval 
are then used to identify the issues and prove that the new solution is at least as 
safe as required. A requirement can be either based on a reference vessel or defined 
by specified risk acceptance criteria. This approach is exemplified within regula- 
tion 17 of SOLAS-II.2 on fire safety. This first variant of risk-based ship design has 
become widely known as “Safety Equivalence”. Second, it is the optimization of a 
rule-compliant vessel aiming to increase the level of safety at the same costs or to 
increase earning potential at the same level of safety. An example for this variant 
of risk-based design is optimization within the new probabilistic damage stability 
regulations. 

For both variants of risk-based design and for risk-based design in general, the 
same technology and frameworks are needed, which derive from the introduction 
of safety as an objective in the design process. First, a design methodology needs 
to be developed, aligned with the traditional design process that includes safety 
as objective and integrate any associated computational tools to quantify pertinent 
risks. Second, the regulatory framework must be in place to facilitate risk-based 
design — core elements of this are risk evaluation criteria which preferably should 
be agreed at IMO. 


1.2 How Did It Start? 
1.2.1 Probabilistic Damage Stability 


Risk-based approaches in the shipping industry started with the concept of proba- 
bilistic damage stability in the early sixties, but it took more than a decade for this 
concept to be introduced in the SOLAS regulations (SOLAS74) as an alternative 
to deterministic damage stability regulations. SOLAS U-1, regulation 25, indicates 
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that alternative arrangements are acceptable if at least the same degree of safety as 
represented by the deterministic damage stability regulation is achieved. However, 
each case must be reported to IMO individually. Resolution A.265 (VIII) defines 
subdivision and stability of passenger ships in terms of the probabilistic concept 
as an equivalent to the regulation 25 of SOLAS. The rules require that an attained 
subdivision index A is larger than or equal to the required subdivision index R. The 
subdivision index R, which has been derived by statistical analysis of the A data of 
ships with satisfactory level of safety, is prescriptive in nature as it depends on ship 
length, persons onboard and life boat capacity. No operational aspects are included 
in R. The attained subdivision index A summarizes the probability of flooding for 
each compartment or group of compartments in case of collision multiplied with 
their contribution to the probability of sinking. 

The amendments of these rules, which have been intensively developed over the 
past decade, are based on the “probabilistic” method of determining damage sta- 
bility. They make use of results from a detailed study of accident data collected by 
IMO relating to collisions. Because they are based on statistical evidence concern- 
ing what actually happens when ships collide and in view of the probabilistic nature 
of the approach, the new probabilistic concept is believed to be far more realistic 
than the previously used “deterministic” method (SOLAS 90) for passenger ships 
and the outdated probabilistic concept used for dry cargo ships, despite the fact that 
some part of the determination of A is prescriptive (and deterministic) in nature. The 
project HARDER (1999-2003) investigated all elements of the existing approach 
and proposed new formulations for the probabilistic approach to damage stability 
taking into account enhanced probabilistic data. The final recommendations were 
submitted as SLF 46/3/3. The new harmonized damage stability regulations for pas- 
senger and cargo ships were adopted by MSC 80 (May 2005) and are entering into 
force on | January 2009. It is expected that the new requirements will lead to ship 
designs incorporating novel sub-division concepts (Papanikolaou 2007). 

An early application of the safety equivalence concept to damage stability was 
proposed for the approval procedure of alternative hull structures in line with SO- 
LAS II-1/25, see SLF 46/INF.10. The approach addresses the critical deformation 
energy in case of side collision of a strengthened design compared to that of a refer- 
ence double hull design complying with the damage stability calculations detailed 
in SOLAS I-1/25. The proposed approach introduces a prescriptive procedure into 
the probabilistic framework of SOLAS II-1/25. Although the target is to demon- 
strate an equivalent level of structural resistance, the procedure is quite strict and 
many details like, e.g., the generation of finite element models, material properties 
and structural failure criteria are fixed. 


1.2.2 Offshore Industry 


Within the offshore industry in Norway, risk analysis is required to be carried 
out since 1986 to identify risks, implement risk reducing measures, and to alert 
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operators to the risks connected with their activities, see for example Skjong (1999). 
The legislation requires that the authorities be allowed having insight into the 
decision-making processes of the individual enterprise, including policies and tar- 
get safety levels, and that they have access to all safety relevant documentation. 
The Petroleum Safety Authority of Norway then acts — as regulator- on situa- 
tions that are considered not acceptable, but does not approve the documentation 
or the safety targets (as in the United Kingdom); this is the responsibility of the 
owner. The approach is called “self-regulatory”. The Norwegian offshore regula- 
tions are designed to reflect that the operators have full responsibility for their 
activities. 

For the approval of offshore activities in the United Kingdom, a safety case has 
to be produced since 1992 for submission to the Health & Safety Executive. The 
primary objective of a safety case is to ensure an adequate level of safety for a par- 
ticular installation, based upon the management and control of the risks associated 
with it. A central feature of a safety case is that the owner takes responsibility for 
assessing the risks associated with his installation, and for documenting how his 
safety management system limits those risks to an acceptable level. The safety case 
regime is mandatory, i.e. operations cannot legally be commenced or continued until 
a safety case has been compiled by the owner and submitted to the official regulator 
for scrutiny and approval (Peachey 1999). 

A safety case will include a comprehensive description of the installation itself, 
and of its operation and the environment within which it operates. Risks will be 
quantified to the extent it is appropriate to do so. Risk acceptance criteria will be 
set, relevant to the installation and its operational context, and usually in accordance 
with the ALARP (As Low As Reasonably Practical) principle. 

Typically, for a new installation, a design safety case would initially be compiled. 
This would subsequently be developed and expanded into an operational safety 
case as the installation enters service. Thereafter, the safety case would normally be 
subject to regular review, with updating as necessary, to take account of changing 
conditions, ownership, activities, modifications, etc. The effectiveness of the safety 
management system is usually monitored and verified by means of regular audits, 
and compliance with the requirements of the safety case is checked by means of 
inspections. 


1.2.3 Structural Reliability Analysis 


The development of structural reliability analysis started as a new discipline in en- 
gineering in the seventies, when it was shown that a probabilistic theory could be 
developed that linked reliability to rules. Structural reliability analysis represents a 
risk-based framework for developing and documenting rules for structures. The the- 
ory has now been continuously developed over a period of over 35 years and it is 
supported by standardized methods, textbooks and related software tools. The basis 
for the methods and terminology may be found in CEN (2002). 
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In the maritime area, the DNV offshore rules were the first international standards 
applying the new knowledge (see for example the review book on use of Structural 
Reliability Analysis, (Sundararajan 1995, Skjong 1995) and the review on risk and 
reliability in marine structures by Guedes Soares 1998). This was linked to the de- 
velopment of all-year offshore operations in the North Sea, which required a higher 
reliability level than required in the American Petroleum Institute’s offshore stan- 
dards for the Gulf of Mexico where offshore structures were abandoned in case of 
hurricanes. 

In shipping there was little published systematic use of structural reliability anal- 
ysis for rule development or ship design apart from the European funded research 
project SHIPREL which advocated the use of reliability theory in codes and pro- 
posed a reliability based format based on ultimate strength (Guedes Soares et al. 
1996). Starting around 2000, new rules for the hull girder capacity of oil tankers 
were developed using structural reliability analysis within the so-called Joint Tanker 
Project of three major class societies which resulted in the Common Structural Rules 
for tankers (IACS 2006). The approach and selected results were also submitted to 
IMO as MSC 81 /INF.6. 


1.2.4 Alternative Design and Arrangement for Fire 
Safety (SOLAS IT.2/17) 


The development that resulted in SOLAS 1.2, Regulation17, started already back 
in the late eighties with the design of the cruise ship “Sovereign of the Seas”, which 
had an atrium, a public space extending to three or more decks, within one fire zone. 
The approval of this ship involved a reference to the standard for equivalent arrange- 
ments under SOLAS I/5. The atrium solutions were extended to three fire zones in 
the design of the cruise ship “Voyager of the Seas” delivered in 1999 and again 
involved equivalence considerations and reference to SOLAS I/5 (Bahamas 2001). 
The large RoPax/Cruise ferry “Color Fantasy” and the Ultra-Voyager-class of ves- 
sels have atria extending over four fire zones, and using the new SOLAS II-2/17 
for approval. The freedom in design introduced by these regulations facilitates op- 
timization of various design parameters. Various software tools, e.g., for analyzing 
evacuation performance of passenger ships, have been developed and can be used in 
design optimization. Guidelines are published to direct the fire engineering analysis 
(IMO 2001). 


1.2.5 Alternative Design for Oil Tankers (MARPOL Annex I-4/19) 


Regulation 19 addresses double hull and double bottom requirements for oil tankers. 
However, paragraph 5 of Reg. 19 states that other methods of design and construction 
of oil tankers may also be accepted as alternatives to the requirements prescribed 
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in Reg. 19, provided that such methods ensure at least the same level of protection 
against oil pollution in the event of collision or stranding and are approved in princi- 
ple by the Marine Environment Protection Committee (MEPC) based on the revised 
interim guidelines adopted in resolution MEPC 110(49). 

The guidelines provide the framework for the assessment and the oil outflow 
performance of the alternative design. The performance of the proposed alterna- 
tive design is compared with that of a reference design which complies with the 
prescriptive requirements. The assessment employs a probabilistic method and uti- 
lizes damage statistics. However, the approval procedure requires as first step the 
approval in principle by the IMO-MEPC before the final design can be approved 
by a flag state administration. It is noted that the required preliminary approval by 
MEPC has effectively limited innovations in this area. 


1.2.6 Special Craft 


Annex 4 of the High-Speed Craft code (HSC 2004) details the procedures for fail- 
ure mode and effects analysis (FMEA) for selected systems such as for directional 
control systems, machinery systems and their associated controls, electrical system, 
taking into account the effects of electrical failure on the systems being supplied, 
and the stabilization system. However, FMEAs are only considered as a part of a 
broader safety assessment and are not integrated into a whole ship analysis. Each 
system is analyzed as stand-alone system. 

IMO (2002a) released interim guidelines for wing-in-ground (WIG) crafts which 
are supported in their main operational mode solely by aerodynamic forces which 
enable them to operate at low altitude above the sea surface but out of direct contact 
with that surface except for start and landing. The interim guidelines for WIG craft 
were developed in view of the configuration of WIG craft, which falls between the 
maritime and aviation regulatory regimes. The basis for the interim guidelines is 
risk management. Although this is a paradigm shift from the prescriptive standards 
forming the basis of the HSC Code, the intention was to achieve safety standards 
comparable to those of the 1974 SOLAS Convention. However, relevant provisions 
of the HSC Code have been included in the interim guidelines. This means that 
the interim guidelines include prescriptive requirements and risk-based issues. The 
safety assessment follows the established procedure of the aerospace industry (SAE 
1996). 

Although not many WIG craft are operated today, the interim guidelines are a 
good example of new rules for novel vehicles that cannot be regulated only with ex- 
isting rules. The interim guidelines also showed how to combine existing elements 
into a new regulatory framework. The preamble of the interim guidelines stresses the 
fact that risk and safety levels need to be assessed on a holistic basis, recognizing 
that high levels of operator training, comprehensive and thoroughly implemented 
procedures, high levels of automation and sophisticated software can all make sig- 
nificant contributions to risk reduction. The general part of the interim guidelines 
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introduces requirements related to operator management, similar to the International 
Safety Management code (ISM 2004) and operation limits (good weather, near place 
of refuge and rescue facilities available). 


1.2.7 Formal Safety Assessment 


Formal Safety Assessment (FSA) has been developed as tool to support decision 
making at IMO. Following a UK proposal in 1993, guidelines for FSA were even- 
tually adopted for use in the IMO rule making process (IMO 2002b), following a 
series of trial applications according to the interim guidelines. The guidelines have 
been updated recently (IMO 2007). With FSA, the maritime industry followed oth- 
ers sectors in adopting a risk-based approach to support rule-making. FSA deliv- 
ers in a transparent way the costs and benefits of proposed changes to the regula- 
tory framework and supports decision makers at IMO. FSA comprise five interre- 
lated steps: 


. Identification of hazards 

. Assessment of the risks arising from the hazards identified 
. Identification of options to control the risks 

. Cost/benefit assessment of the risk control options 

. Recommendations for decision making 


NAP WN Re 


To date, only a couple FSA studies performed within the maritime industry re- 
sulted in IMO decisions. One early application was related to the provision of he- 
licopter landing areas (HLA) on passenger ships and the FSA showed these to be 
not cost-effective for non RoPax passenger ships. The requirement was eventually 
dropped, though many ships, including non-Ro-Ro passenger ships, have in the 
meantime an HLA installed. More prominent is the bulk carrier safety “story” when 
a couple of FSA studies were prepared which concluded, among other issues, that 
double skins are cost-effective, see MSC 76/23. However, this recommendation was 
later also not adopted. A recent FSA study on cruise vessel navigation (NAV 51/10) 
focused on events leading to collisions and groundings. It concluded in documenting 
a number of risk control options related to navigation as being cost-effective, among 
them ECDIS (Electronic Chart Display and Information System). A dedicated FSA 
study on ECDIS addressing also other ship types was performed following the FSA 
on cruise vessel navigation. It confirms the cost-effectiveness of ECDIS for selected 
cargo vessels; see MSC 81/24/5. A series of so called high level FSA studies were 
performed recently for main ship types as follows (with the INF-papers containing 
the full studies): 


Container vessels, submitted as MSC 83/21/2 and MSC 83/INE.8 

Liquefied natural gas tankers, submitted as MSC 83/21/1 and MSC 83/INF.3 
Cruise vessels, submitted as MSC 85/17/1 and MSC 85/INF.2 

RoPax ferries, submitted to MSC 85/17/2 and MSC 85/INF.3 

Oil tankers, submitted to MEPC 58/17/2 and MEPC 58/INF.2 
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1.2.8 Selected Recent Research Activities 


Following a number of tragic accidents with RoPax ferries in Europe, research was 
initiated to study possible means to improve the safety of those vessels. A thematic 
network was established in 1997 to coordinate and align related European research 
projects, mainly those funded by the EU-Commission. The theme was called “De- 
sign for Safety” which called for integrating safety as an objective into the design 
process; and it can be seen as first version of risk-based ship design (Vassalos 
et al. 2000, University of Strathclyde 2003). Coordinated projects focused on de- 
velopment of tools to predict the safety performance in accidental conditions like, 
e.g., collision and grounding (e.g., Otto et al. 2001, Vanem and Skjong 2004a), bow 
door and green water extreme hydrodynamic loads (e.g., Sames et al. 2001, Sames 
2002), loss of structural integrity (e.g., Chan and Incecik 2000), fire (e.g. Vanem 
and Skjong 2004b), flooding (e.g., Papanikolaou et al. 2000, Vassalos 2004), mus- 
tering and evacuation (e.g., Vassalos et al. 2001, Dogliani et al. 2004). In addition, 
projects developed the basics for a new design framework which integrates safety 
and demonstrated the integration of tools for fast optimization of ship designs. Par- 
ticular attention was focused on developing a new probabilistic damage stability 
assessment concept for passenger and dry cargo ships that formed later the basis 
for the new harmonized damage stability regulations adopted by IMO. The most 
recent analysis, design and integration of risk-based approaches were performed 
for Aframax oil tankers (Papanikolaou et al. 2006). In the European research area, 
research into ship safety was later concentrated into the large project SAFEDOR 
which included also developments towards a modern regulatory framework and a 
large number of sample design applications for ships and ship systems (Breinholt 
et al. 2007b). A list of related research projects is provided in the references to this 
chapter. 

Research into risk-based approaches took also place outside Europe, in particu- 
lar in Japan and South-Korea. Kaneko (2002) presented a holistic methodology for 
risk evaluation of ships. He focused on prediction of collision probability and fire 
scenarios and showed a cabin fire as example application. An overview of current 
research activities in Asia is provided by Yoshida (2007). Kaneko (2007) presented 
an overview of approaches in risk modeling and pointed towards uncertainties in- 
volved. An ongoing development into a total risk management system was presented 
by Lee (2007) focusing on integrating available tools for design, regulation and op- 
eration. The system is supposed to run in real time delivering input for a simulator, 
too. Risks are computed using standard risk models, e.g., event and fault trees, for 
a number of scenarios. A database holding generic data aims to accelerate the com- 
putation. 


1.2.9 Recent Regulatory Developments 


Goal-based Standards (GBS) were put on the agenda of the Maritime Safety Com- 
mittee (MSC), by a decision of the IMO Council (89) in 2002. The first work- 
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ing group on GBS was established in December 2004 at IMO, MSC 79, and 
the discussion resulted in general agreement of a definition of GBS, and a gen- 
eral five-tier system of regulations. The working group reconvened at MSC 80, 
MSC 81, MSC 82 and MSC 83 and three correspondence groups were active in 
between. 

Two clearly distinct directions to GBS have emerged. First, a deterministic ap- 
proach is followed which is currently piloted for bulk carrier and tanker using the 
IACS Common Structural Rules as subject case to finalise the verification process. 
This deterministic approach is not truely goal-based and has no connections to risk- 
based design. Second, the so-called Safety Level Approach (SLA) was introduced 
(MSC 81/6/2) aiming to establish a risk-based regulatory framework building on 
principles already known from formal safety assessment (FSA). GBS, when based 
on SLA, use the IMO approach to risk acceptance to define a level of acceptable 
reliability at any level (ship, ship function, system, subsystem or component). This 
facilitates the development of modern rules or regulations in a consistent, transpar- 
ent and reliable manner. 

At MSC 82, a new guideline on alternative design and arrangements for SOLAS 
chapter II-1 and II was developed and agreed to enter into force in 2009 (IMO 
2006). These guidelines complement the tool set for ship designers but, unfortu- 
nately, introduce a number of new terms which were not used before. An alternative 
approval procedure for ship systems, fully inline with earlier published guidelines 
and terminology was presented by Hamann (2007). 

In 2010 the new SOLAS regulations for cruise ships I]-1/8-1, I-2/21 and 
II-2/22 will come into force. Collectively, these regulations call for a new approach 
to passenger ship safety, called “Safe Return to Port’. Requirements for ship sys- 
tems in accidental conditions like fire and flooding will be specified for the first time. 
The new requirements may lead to novel ship designs and higher redundancies. 


1.3 A High-Level Introduction to Risk-Based Design 
and Approval 


1.3.1 Linking Risk-Based Design and Approval 


Risk-based design is considered an enhanced variant of the traditional design pro- 
cess and it integrates safety as additional design objective. Therefore, one additional 
constraint enters the design optimization as follows: 


Rbdesign < Racceptable (1.1) 


with Rpesign the risk of the considered ship or system and Racceprable the acceptable 
risk. In general, risk is the product of the frequency of an event times the associ- 
ated consequences. Different risk categories like, e.g., human life, environment or 
property, need to be distinguished 
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The risk of the design Rpesign 18 typically the sum of partial risks coming from 
different accident categories like, e.g., collision, fire or grounding. Each partial risk 
can be computed with the help of risk models like, e.g., event trees or Bayesian 
networks. The choice of a risk model depends on the application. Fault trees are 
widely used for system analysis. Event trees and Bayesian networks have been used 
in FSA studies. Risk models expressed by mathematical formulae were developed 
for fast design optimization. 

The acceptable risk Racceprabie 18 Specified by the approval authority (flag state 
administration and/or classification society) in case of human life and environmental 
protection. The acceptable risk related to loss of property and business is usually 
defined by the owner or operator, and is not considered any further in the following. 
Two options exist to specify the acceptable risk: relative or absolute. In the first case, 
a reference design is selected which complies with current rules. In the second case, 
IMO risk acceptance criteria are used or referenced. 


1.3.2 How Risk-Based Design and Approval Work Together 


Currently accepted and used risk-based design approaches are two-step approaches 
involving qualitative and quantitative steps (Breinholt et al. 2007a). The currently 
proposed risk-based approval process is also a two-step process. The qualitative 
step ends with a preliminary approval which documents the requirements for the 
full approval. The obvious question for future risk-based design is how much effort 
is needed upfront to explore the design solution space without preliminary approval 
from an approval authority. Additional activities within risk-based design and ap- 
proval processes have to be aligned with existing schedules for owners, yards and 
suppliers. Ideally, a yard seeks to build-up complete knowledge of the expected risk 
analysis and its results before the contract with the owner is signed. This means that 
a significant amount of analysis may need to be carried out prior to the application 
for preliminary approval and before the detailed approval requirements are issued. 
On the other hand, investing too much effort before an indication of feasibility is 
not advisable. 

Key milestones in the combined design and approval schedules are design con- 
cept, final design, letter of intent, contract, preliminary approval and final approval. 
It is emphasized that the alignment of these milestones will vary according to the ac- 
tual case. The alignment of schedules for a smaller risk-based design case indicates 
that after signature of the letter of intent, the yard starts to produce a full design con- 
cept which is then previewed with the approval authority to decide whether a risk- 
based approval is needed or not. If needed, the qualitative phase of the design and 
approval is entered which concludes with the preliminary approval by the approval 
authority. Once the conditions attached to the preliminary approval are known — and 
are acceptable — the yard approaches the owner to sign the contract. Following this 
key milestone, a quantitative analysis is started which — together with the traditional 
design activities in this stage — eventually results in an approved design. 
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For truly challenging and larger risk-based design projects, the quantitative part 
of the risk assessment is most likely carried out before the letter of intent and, 
therefore, well before the preliminary approval. The main reason is that yards do not 
want the process to be interrupted by the relatively late preliminary approval. Yards 
ideally seek to have all issues affecting the design and approval process solved be- 
fore applying for approval. It is noted in this context that one additional objective 
of risk-based design is to increase the knowledge about the ship design in the early 
design phase and, therefore, to facilitate an advance of the decision making. Thus, 
with advanced tools available, a risk analysis on key aspects can be performed cost- 
effectively before a letter of intent is signed. 


1.4 What is Needed to Make Risk-Based Design 
and Approval Work? 


1.4.1 Regulatory Framework 


The regulatory framework comprises IMO regulations, classification societies’ rules, 
regional and national regulations and industry standards. Details of a modern risk- 
based regulatory framework are described in Chap. 3. This includes a comprehen- 
sive review of Formal Safety Assessment developments in the shipping and other 
industries. The approval of risk-based design is detailed in Chap. 4. 

To facilitate risk-based design and approval, three main elements are needed and 
most of these are already in place: 


e Provisions for risk-based designs 
SOLAS I/5 and MARPOL Annex I, I/5 have the necessary provision to allow al- 
ternative designs and arrangements. In addition, alternatives are possible related 
to fire safety and in the near future for electrical systems and lifeboats. 

e Approval procedures 
A number of IMO documents exist to guide the approval process for alternative 
designs. In addition, SAFEDOR developed a high-level approval process and a 
system-level approval process for risk-based designs. 

e Risk evaluation and acceptance criteria 
The FSA guidelines detail criteria related to human life safety, addressing indi- 
vidual and societal risks. Risk acceptance criteria related to the environment are 
not yet agreed at IMO but were proposed by Skjong et al. (2006). Furthermore, 
all FSA studies submitted and reviewed by IMO can be used as a reference. 


1.4.2 Design Framework and Tools 


The design framework couples traditional design with risk-based thinking. It de- 
scribes the integration of safety as an additional design objective. Risk-based design 
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is described in detail in Chap. 2. Advanced methods and simulation tools are dis- 
cussed in Chap. 5. 
The toolbox of the engineer engaged in risk-based designs should comprise 


e Safety-performance prediction tools 
The necessary software tools derive from the actual application. In general, tools 
to predict frequency and consequences for all accident categories are needed. 

e Risk models 
These models also depend on the actual application. In general, fault trees may be 
used for system analysis, event trees and Bayesian networks in FSA studies, and 
risk models expressed by mathematical formulae for fast design optimization. 

e Optimization platform 
As for the traditional design, optimization is required to achieve best designs. 
With new constraints and objectives in the risk-based design being added to the 
optimization problem, parametric ship models are needed, too. 


1.4.3 Qualified Engineers 


As with all technical disciplines, the qualification of the people involved is decisive 
for the economic success. Training, proper documentation and dissemination are 
among the issues which SAFEDOR has addressed by a variety of activities aiming 
to improve the qualification and knowledge base of both young and more experi- 
enced marine engineers and naval architects. This book on risk-based ship design 
should be understood as one basic element of the SAFEDOR training and dissemi- 
nation plan. 
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Chapter 2 
Risk-Based Ship Design 


Dracos Vassalos 


Abstract This chapter aims to present an overview of risk-based design develop- 
ments over the recent past and to attempt to demonstrate that substantial pre-requisite 
scientific and technological developments are in place for Risk-Based Design to be 
fully implemented in the maritime industry. To elucidate the realisation of the risk- 
based ship design concept through application, a variety of examples at basic and 
holistic levels using RoPax and cruise liners are presented and discussed in the sec- 
ond part of the present chapter. 


2.1 Methodological Approach to Risk-Based Ship Design 


Phenomenal changes in scientific and technological developments at an ever in- 
creasing pace and an overall improved technical capability at a much larger scale 
are fuelling innovation in the shipping sector to meet the demand for larger, faster, 
more complex and specialised ships. This is taking place in an industry that is 
still fragmented, undermanned and intensely competitive and in a society that is 
more vigilant and more demanding on issues pertaining to human life safety and 
the environment. Safety could easily be undermined and the consequences would 
be disastrous. This is particularly true for knowledge-intensive and safety-critical 
ships, such as the giants of the cruise ship industry being built today, where the 
need for innovation creates unprecedented safety challenges that cannot be sus- 
tained by prescription. In this state of affairs, a new design paradigm that treats 
safety as a design objective rather than through rule compliance (Design for Safety) 
and a formalised methodology capable of embracing innovation through routine 
utilisation of first-principles tools, thus leading to cost-effective ways of dealing 
with safety (Risk-Based Design) are being advocated by the EU maritime industry 
as the “bridge” for the emerging gap. Surprisingly, the biggest influence so far is 
seen at the birth place of prescription: “The future is Risk-Based” was proclaimed 
recently at the International Maritime Organization (IMO), the new harmonised 
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probabilistic rules for damage stability, SOLAS Chapter H-1, due for enforcement 
in 2009, have already found a way to the design offices of major yards, application 
of SOLAS Chapter II-2 Reg.17 on safety equivalence is becoming almost routine 
and Goal-Based Standards too trendy to resist. It would seem obvious that some 
owners and consequentially yards and classification societies are venturing to ex- 
ploit the new degrees of freedom afforded by goal-based approaches whilst others 
are finding it rather difficult to move away from the prescription mindset that has 
been deeply ingrained in their way of conceptualising, creating and completing a 
ship design. “Inertia” and “momentum” are not the best of friends and when they 
clash there is a lot of “dust”. Is it all going too fast and where is it going? What 
is the common thread and how do we get hold of it? Total freedom it appears is 
hard to cope with and a helping hand is needed to guide cross the line from pre- 
scriptive to goal-setting design and regulation. Moreover, the adoption of risk-based 
approaches in the maritime industry is not as straight forward as it was thought and 
risk-assessment not as amenable to traditional naval architecture tools as rule com- 
pliance. Furthermore, the use of first-principles tools and the volume of analysis re- 
quired addressing safety as a life-cycle issue within integrated design environments 
and holistic approaches are not meeting fertile ground among the maritime profes- 
sion. Not withstanding the above and the monumental effort required to crossing 
this bridge, it is gratifying for all the proponents of Risk-Based Design to experi- 
ence the crossing of the bridge and very rewarding to see early results that fully jus- 
tify such effort. The real problem that remains is one of inculcation, education and 
training. 

Assisting in this direction, this chapter aims to present an overview of risk-based 
design developments over the recent past and to attempt to demonstrate that substan- 
tial pre-requisite scientific and technological developments are in place for Risk- 
Based Design to be fully implemented in the maritime industry and to elucidate its 
realisation through application examples at basic and holistic levels using RoPax 
and cruise liners through a Design Story that follows this section. 


2.1.1 Introduction 


The need to change the way safety is being dealt with is forcing the realisation that 
the marine industry is a “risk industry”, thus necessitating the adoption of risk-based 
and hence performance-based approaches to maritime safety. This, in turn, is paving 
the way to drastic evolutionary changes in ship design and operation. Notable efforts 
to respond to these developments in the marine industry led to the establishment of 
the first significant EU Thematic Network SAFER EURORO (1997-2001), aim- 
ing to promote a new design philosophy under the theme “Design for Safety” with 
the view to integrating safety cost-effectively within the design process in a way 
that safety “drives” ship design and operation. This in turn led to the development 
of a formal state-of-the-art design methodology (Risk-Based Design) to support 
and nurture a safety culture paradigm in the ship design process by treating safety 
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as a design objective rather than a constraint. It also provided the inspiration and 
the foundation for SAFEDOR (2004 — Design/Operation/Regulation for Safety), a 
20-million Euro EU FP6 Integrated Project of 4 years duration, aimed at integrating 
safety research in Europe and beyond and to fully implement Risk-Based Design 
(RBD) from concept development to approval. 

Considering the above, adopting a RBD methodology that embraces innovation 
and promotes routine utilisation of first-principles tools will lead to cost-effective 
ways of dealing with safety and to building and sustaining competitive advantage, 
particularly so for knowledge-intensive and safety-critical ships, such as the giants 
of the cruise ship industry being built today; knowledge-intensive, as such ship con- 
cepts are fuelled by innovation and safety-critical as with such ship designs safety 
is indeed a design “driver”. In this respect, the continuously increasing regard for 
human life and the rapid escalation in ship size (the age of mega-ships is clearly 
upon us and it is here to stay) have prompted thorough revision of pertinent safety 
standards to the extent that risk containment, in a way that public confidence is as- 
sured, has become a top agenda item at IMO. Experience finds no fertile ground to 
breed and the regulatory system is stretched to breaking point. Conjecture will not 
do, for the risk is too high. Difficult questions demand (and deserve) answers that 
can be measured, verified and defended. Responding to societal expectation for ship 
safety by setting goals that encourage zero tolerance, with regard to human life loss 
and environmental impact, demands close scrutiny of all the issues that could up- 
set such expectation, first and foremost, survivability in case of a casualty. Striving 
to understand what is to be done and how best to achieve it led to the introduc- 
tion of new “buzz” words such as “casualty threshold”, “time to flood”, “safe area’, 
“safe return to port’, safety level”, which tend to cloud the problem at hand. Sim- 
ilarly, revision of safety standards demands a critical review of all pertinent issues 
ranging from accident causality (leading to identification of principal hazards and 
design scenarios), accident consequences (e.g. damage survivability and fire safety 
analysis) and mitigation measures, either in place historically (e.g., evacuation and 
rescue) or potential new measures (e.g. residual functionality of ship systems in an 
emergency). 

But whilst the intention has been good, the pace of development has been too 
fast for comfort, leading to a rather unclear situation that engulfs the whole pro- 
fession. The need for clarity is immediate and it is paramount. It also provides the 
motivation for this Chapter, which draws from developments over the past 13 years 
to present the current state-of-the-art on RBD as it is being applied, mainly to the 
cruise ship industry, and how it relates to the rule making process at IMO. The Chap- 
ter starts by briefly addressing rules-based design before delineating a roadmap to 
risk-based design development as a goal-setting approach that is linked directly to 
the IMO framework for passenger ship safety and to the more overarching and more 
fundamental issue of measurable safety levels through quantitative assessment of 
total risk. RBD implementation results at concept design level are presented where 
appropriate, using a generic cruise ship design, to facilitate better understanding of 
the methodology and of the pre-requisite scientific and technological developments 
necessary for such implementation. 
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2.1.2 The Ship Design Process 


2.1.2.1 Rules-Based Design 


The aim in ship design practice today is to deliver a vessel that performs in 
accordance with the expectations defined by the owner’s operational or func- 
tional requirements while complying with the statutory rules and regulations (hence 
“Rules-Based Design’’) as well as ensuring that the construction process keeps to 
budget and schedule. The role of the yard in this process must not be overlooked; 
the fact that shipyard practice is reflected in ship design suggests that instilling a 
safety culture in the yard is of paramount importance in dealing with safety in ship 
design. A possible generic and high-level representation of the ship design process is 
shown in Fig. 2.1, (Vassalos et al. 2006). This representation is by no means unique 
or exhaustive but it will be used subsequently as a basis for underlining the expected 
contribution and implications of risk-based design. 

As illustrated in Fig. 2.2, design input concerns “performance” expectations on 
one hand and on the other requirements deriving from the ship owner’s own mar- 
ket, business and logistics analysis as well as from other expectations from per- 
tinent stakeholders (e.g., shareholders, public opinion, charterers, customers and 
shipyards). 

Design studies as depicted in Fig. 2.3 concern in the main design optimisation, 
a juggling act of many factors including among others safe operation, technical 
performance, preferences, cost, logistics and aesthetics. In this list, safety is not 
considered later than anything else, but it is limited to rule compliance and hence it is 
treated as a design constraint — not as a design variable satisfying set criteria. At the 
early design stages, where major design decisions are made and cost items assigned, 
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design decision making is based mainly on the designer’s experience, engineering 
judgment and the level of creativity possible within the prescriptive rule envelope. In 
rule-based design, safety performance is prescribed by rules, i.e. rules define what 
the safety performance parameters are and what values should be attained (design 
criteria). Some examples of these are listed next: 


To avoid structural failure: minimum scantlings, corrosion margins, design 


To avoid loss of stability: GZ-curve requirements, etc. 
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To mitigate the consequences of grounding: double bottom extent and height, etc. 
To mitigate the consequences of a fire: fire rating — Ih fire protection (ATmax = 
180°C, etc.), maximum length and area of a Main Vertical Zone (MVZ) (48 m, 
1600 m2, respectively), etc. 


This approach implies that development of “competitive” designs is based on the 
designer’s competence rather than on rational and more informed bases. In so doing, 
more often than not, potentially good designs are not allowed to progress further as 
they do not comply with this or the other safety rule. As a result, this has lead to the 
ill-based concept that investment in safety compromises returns. 

Moreover, compliance with prescriptive regulations implies absolute trust that 
the minimum safety level implicit in them is deemed to be appropriate for the type 
of vessel and operation intended; unfortunately this often proves to be conjecture. 
There are of course positive as well as negative sides to “rule-compliance” as out- 
lined next: 


e Rules are minimum requirements that reflect average safety, hence may not be 
appropriate, consistent, and/or optimal in all cases (e.g., SOLAS A.167, SO- 
LAS‘95, even SOLAS 2009). 

e Most rules are developed in the wake of major accidents; as such, they are target- 
ing to reduce consequences to appease public outrage; in some cases, emphasis 
or even relevance to design is all but lost. 

e Ifthe evaluated design does not correspond to the data set used to derive the rules, 
then the design may be unnecessarily penalised or its safety-performance might 
not be optimal or it might even be unsafe. For instance, would the probabilistic 
rules in their current form be applicable to multi-hull vessels? 

e Inarule-based regime “there is no chance to beat the competitors”, as advances 
in technology are conveyed to others by the (prescriptive) rules. On the other 
hand, with safety imposed as a constraint to the design process, the transfer of 
knowledge between the design, production and operational phases is hindered 
(rule evolution is too slow). 

e By specifying minimum requirements, a design that fulfils a requirement by far 
is considered to be of the same safety level as a design that just “passes” the re- 
quirement — this is normally why designers do not achieve a balance (best com- 
promise) and a key reason leading to the conclusion that “safety costs” or at best 
“safety does not pay”. 

e More importantly, knowledge of the actual safety level provision within prescrip- 
tive rules is missing (i.e., compliance with rules does not guarantee satisfactory 
safety performance). Do we know, for example, what is the risk in designing one 
or two compartment passenger ships, as provided in SOLAS today (see Fig. 2.4)? 

e Moreover, the rule-making process is consensus-based and reflects more often 
than not “unjustifiable” compromises that defy the very source of knowledge, 
such rules derive from (experiential or statistical). For example, statistics show 
(see Fig. 2.5) that the B/5 longitudinal bulkhead, used in SOLAS ‘90 to provide 
protection from flooding of a ship’s internal spaces in a side collision, would be 
breached in 45% of such collisions. 
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e Rules are however easier to fulfill and facilitate class/flag changes (desirable). 
They are easy to apply and easy to check for the unskilled (which is rather unde- 
sirable). 


Summarising the foregoing more succinctly, the main pitfalls of rules-based de- 
sign are: 


e Treating safety as a constraint (rule compliance) implies that meeting safety ex- 
pectations cost-effectively is left to chance. 
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Fig. 2.5 Rules do not always reflect experience 
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e Incompatibility of design and performance evaluation tools, time limitations, 
lack of an integrated design environment; all hinder design optimisation in the 
design process. 

e Lack of a formal optimisation process also implies that life-cycle issues (future 
costs/earning potential) are not being taken “explicitly” into account in design 
decision-making. 


Despite these pitfalls, over the years, most rules have proved to “serve reason- 
ably well” the design objectives and most changes and improvements have been the 
result of individual high-profile accidents (e.g., the ferry MV Estonia in 1994) or 
significant changes in casualty statistics (e.g. bulk carrier losses in the early 1990s 
and development of SOLAS Chapter XII). However, rather than waiting for an ac- 
cident to happen and then act in haste to set up new rules that may even end up 
undermining rather than improving safety, all pertinent knowledge deriving from 
such accidents could be analysed and stored in a structured way and used as early as 
possible in the design process (as shown in Fig. 2.6), then a drastic shift of empha- 
sis on prevention must surely be witnessed. Further more, doing so would allow for 
trade-offs between safety and other design factors and would lead to safer and more 
competitive designs. 

It is indeed the concept design stage that holds the greatest potential for intro- 
ducing product and safety innovations. Ship design, in particular, is uniquely char- 
acterised by the fact that some of the most important decisions regarding the vessel 
are taken at the early stages of the process. This allows little possibility to positively 
affect cost and performance in all later design actions, which are inevitably bound 
within the set frame prescribed by the early decisions as illustrated in Fig. 2.7. As 
the design process proceeds, the knowledge about the design increases while at the 
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Fig. 2.6 A “common sense” approach to ship design 
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Fig. 2.7 Design decision-making shift 


same time the freedom to make changes decreases due to the large costs associ- 
ated with these changes. To become more competitive, a decision-making shift is 
required towards the pre-contract stage and hence efforts must be deployed to max- 
imise knowledge that can be achieved only by advanced first-principles tools. 

Emphasis towards approaches that use routinely first-principles calculations 
for explicit consideration of safety performance would allow for goal-setting and 
performance-based design and hence for the possibility of optimising ship perfor- 
mance without regulatory constraints. This would make a significant difference in 
ship design decision-making as the best design solution (from all relevant perspec- 
tives) may lie outside the regulatory envelope. Established optimisation tools and 
techniques can help the designer to explore a much wider design solution envelope 
(see Fig. 2.8) within the time scale available during early design concept develop- 
ment and beyond. 

All these common sense steps provide the foundation for the adoption of “risk- 
based” approaches in design and operation. There is of course an added compli- 
cation and a fundamental difference: the simultaneous consideration of multiple 
risks (major deviation from prescriptive rules and SOLAS in general) that requires 
a holistic approach to safety as described in the next section. 
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Fig. 2.8 Possible design solution envelopes 
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2.1.2.2 Risk-Based Design 


Recent discussions at IMO concerning Goal-Based Standards have given rise to the 
term “Safety Level” designating the through-life level of acceptable “risk” associ- 
ated with a particular ship concept and, as such, becoming the new guiding philoso- 
phy to attaining safety cost-effectively. What this entails, however, is no mean task; 
it is nothing less than being able to quantify the life-cycle risk of a vessel by con- 
sidering all “passive” (design) and “active” (operational) safety measures and to do 
so during the concept design stage under extremely tight cost and time constraints. 
This is an enormous and exciting undertaking but the benefits will be massive and 
hence any investment to realise an efficient way to measure safety will be justified. 
The notion of “risk” is usually associated with undesirable events and with shipping 
operations being undoubtedly “risky”; ships should be designed with this in mind. 
In order to address safety explicitly, a consistent and transparent framework needs 
to be adopted for its provision. In this respect, explicit calculation and use of risk 
is considered to provide the most flexible means of setting up such a framework. 
Hence explicit consideration of safety is equivalent to evaluating risk during the 
design; hence the term Risk-Based Design. Application of RBD is biased towards 
design concepts with high levels of innovation (see Fig. 2.9). Hence the need to 
use knowledge in all its forms: best practice, engineering judgment, state-of-the-art 
tools and data; all part of Quantitative Risk Analysis (QRA). 

The essential advance attributable to RBD is the explicit, rational and cost- 
effective treatment of safety. To achieve this, the following principles need to be 
adhered to: 


1. A consistent measure of safety must be employed and a formalised procedure 
of its quantification adopted (risk analysis). For this to be workable, considering 
the complexity of what constitutes safety, a clear focus on key safety “drivers” 
is necessary (major accident categories). Numerous formal procedures for risk 
quantification, risk assessment and risk management exist in various contexts 
(for instance FSA in rule making, safety case for specific design/operational 
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Fig. 2.9 Risk-based design and innovation 
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Fig. 2.10 A high level framework for risk-based design 


solutions, among others). The right-hand-side of Fig. 2.10 illustrates the elements 
of a typical “safety assessment process”. 

2. Such procedure must be integrated in the design process to allow for trade-offs 
between safety and other design factors by utilising overlaps between 
performance, life-cycle cost considerations, functionality and safety. The in- 
terfaces between the ship design process and the safety assessment procedure 
are illustrated in Fig. 2.10. Consequently, additional information on safety per- 
formance and risk will be available for design decision-making and design 
optimisation. 

3. Considering the level of computations that might be necessary to address all per- 
tinent safety concerns and the effect of safety-related design changes on func- 
tionality and other performances, a different handling is required; namely, the 
use of parametric models to allow for trade-offs through overlaps at parame- 
ter level and access to fast and accurate first-principles tools. The design opti- 
misation process becomes thus a typical case of multi-objective, multi-criteria 
optimisation problem. A common ship design model managed within an inte- 
grated design environment (software) will also be required for that process to be 
conducted efficiently. 


The aforementioned RBD principles are reflected in the high-level definition 
promulgated by SADEFOR: RBD is a formalised methodology that integrates sys- 
tematically risk assessment in the design process with prevention/reduction of risk 
embedded as a design objective, alongside “conventional” design objectives. Key 
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to understanding RBD is the integration of risk assessment in the design pro- 
cess and decision-making towards achieving the overall design goals but also as 
part of a parallel (concurrent) iteration within the safety assessment procedure 
to meet safety-related goals/objectives, as depicted by the high-level framework 
of Fig. 2.10. 

Related to this, key elements and implications for ship design are 
considered next. 


Safety Assessment Procedure 


In principle, the safety assessment procedure referred to above is a systematic and 
formalised risk assessment process, which can be carried out in a variety of ways. 
The selection of the right approach may be viewed in the context of the following 
drivers (HSE 2001): 


e Design stage: will determine the level of flexibility to possible design changes 
as well as the level of design knowledge. At concept design stages (pre-contract) 
there is flexibility for major design trade-offs; on the other hand, there is lesser 
knowledge about the ship, hence risk assessment must be limited to coarser 
methods. The risk assessment can — of course — be refined during advanced de- 
sign stages (as more design detail becomes available) and up to construction and 
commissioning processes. 

e Major hazard potential: the greater the potential exposure to total loss or multiple 
fatality, the less desirable is to use only conventional rules-based approaches for 
decision-making. Hence the focus on major ship accident categories. 

e Risk decision context: higher elements of novelty, uncertainty or stakeholder con- 
cern will also push towards more thorough risk assessment, hence the bias of 
risk-based design towards high innovation, high-value vessels. 


Definition of Safety Goals 


Safety goals — as other design goals, are related to the ship’s mission and ship’s pur- 
pose. Explicit safety goals are already part and parcel of the design input. Examples 
of design goals driven by safety considerations (mainly associated with company 
values and policies) include: 


Top-Level Goals 


e No accidents leading to total ship loss (collisions, groundings, stranding, 
fires, etc) 
No loss of human life due to ship related accidents 
Low impact to the environment (no air emissions, low noise, low wash) 
Minimum impact to the environment in case of a ship accident 
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Specific Technical Goals (Objectives) 


e Vessel to remain upright and afloat in all feasible operational loading and 
environmental conditions 
Vessel to remain upright and afloat in case of water ingress and flooding 
Ship structure to withstand all foreseeable loads during its lifetime (e.g., no 
extreme load structural failure or fatigue failure of key structural members) 
Sufficient residual structural strength in damage conditions 
High passenger comfort (no sea sickness, low vibration levels, low noise 
levels) 


Similar safety goals (objectives) may be implicit in statutory or class require- 
ments for risk acceptability — if such are available for approval purposes. Other 
design goals may include turnaround time, service speed, capacity, services and, in 
general, requirements rendering the ship fit for purpose. 


Identification of Hazards 


In order to achieve generic safety goals (objectives) as those stated above, more 
specific functional requirements must be defined so that compliance with such re- 
quirements would ensure achievement of the safety goals (objectives). In line with 
risk-based approaches, the identification of such requirements must be based on a 
systematic and rational assessment of what can impede the achievement of the safety 
goals; thus the “what-can-go-wrong” question must be explored systematically. 
This can be accomplished using hazard identification techniques. Hazard identifi- 
cation is usually a qualitative exercise based primarily on expert judgment. Various 
techniques and formats for reporting are available depending on the case, the pur- 
pose and the level of the design knowledge available (HAZID, FMEA, SWIFT, 
HAZOP, etc.). 


Identification of Critical Design Scenarios 


What makes risk-based design feasible and manageable, hence practicable, derives 
from the fact that ship safety, as a top-down process, is governed only by a handful 
of factors which, when considered individually or in combination, define a limited 
set of design scenarios with calculable probabilities of occurrence and consequences 
that could collectively quantify the life-cycle risk of a ship at sea. These relate to 
accident categories with major hazard potential, thus can be derived from hazard 
identification. When generic design scenarios are available, these must be adapted 
and customised to the specific design features and expected performances of the 
vessel in question (Fig. 2.11). 
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Fig. 2.11 Typical structural links of design scenarios 


Definition of (Safety-Related) Functional Requirements 


Once a list of prioritised hazards is available (based on qualitative ranking of risk) 
along with relevant design scenarios, specific functional requirements and evalua- 
tion parameters need to be formulated. These can be seen as an additional set (in 
relation to the normal set of performances) of safety performance requirements. 
These, of necessity, must be based on engineering judgment and available safety 
knowledge. With a consolidated list of safety-related functional requirements, the 
design process can proceed as normally. Such requirements will, alongside other 
conventional design requirements, be used by a designer to put together the first 
base line design and to identify design disciplines for evaluation. 


Design Decision-Making 


Use of risk analysis or alternatively of risk-knowledge models in ship design would 
provide additional information on safety performance and risk levels to the design 
decision-making process. The use of risk-knowledge models would allow such in- 
formation to be easily re-calculated if design changes are made. If similar parametric 
models existed for other ship performances (weight, efficiency, capacity, etc.) and 
economic implications (relative initial and running costs, earning potential, etc.) 
then it would be possible to make major design decisions and trade-offs optimally 
and cost-effectively in a practical time-scale. 

In relation to design decision-making, in the same way as there are explicit ship 
performance evaluation criteria (design criteria), and economic “targets” (within 
owner’s requirements) there is a need to define safety performance evaluation cri- 
teria and risk acceptance criteria. The latter could be related to safety performance 
criteria, so that safety performance could be used in the design iterations, alongside 
or even instead of explicit risk acceptance criteria. As a result, key design aspects 
of the initial baseline designs (watertight subdivision, structural design, internal 
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layout, main vertical zones, bridge layout, materials, major ship systems, etc.) can 
be optimised from the point of view of ship performance, cost implications, po- 
tential earnings whilst ensuring that the safety performance level (as quantified) is 
appropriate and commensurate with acceptable and quantified risk levels (provided 
that such do exist). 

It is obvious that some design decisions determine the construction costs, other 
determine the operating cost and potential earnings. Whilst ship designers are, to 
a large extent, able to manage the construction costs, it is unlikely that they would 
be able to do the same with the operational economic profile of the vessel. For the 
former, shipyards possess detailed knowledge and empirical models (indeed such 
relationships do exist within shipyards) to estimate construction costs. For the lat- 
ter, it is the shipyards’ clients (the ship owners) who possess detailed knowledge 
and working models of their operational costs and earnings profile. Notwithstand- 
ing the above, the ultimate decision about the design parameters and variables lies of 
course with the designers themselves and other involved stakeholders (ship owner, 
shipyard, etc.). The quantified ship performances (technical performance, safety per- 
formance, costs, earning potential, and risk) would be weighted alongside other fac- 
tors that are outside the design studies themselves (preferences, company policies, 
etc). In this context, ship design decision-making could be illustrated as indicated in 
Fig. 2.12. 

A key aspect to risk-based design is that any ship design decision will be well- 
informed and will lead to design concepts that are technically sound (at least to a 
level commensurate with the current available state-of-the-art), fit for purpose, and 
last but not least, with a known level of safety that is more likely (than by following 
rules) to meet modern safety expectations. 
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Fig. 2.12 Making in risk-based design 
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2.1.3 Contemporary Developments 


Contemporary regulatory developments are already a step ahead, necessitating con- 
certed effort at global level to ensure safe transition from deterministic to goal-based 
safety. More specifically, in May 2000, the IMO Secretary-General called for a crit- 
ical review of the safety of large passenger ships noting that “what merits due con- 
sideration is whether SOLAS requirements, several of which were drafted before 
some of these large ships were built, duly address all the safety aspects of their op- 
eration — in particular, in emergency situations”. This visionary prompt led IMO 
Maritime Safety Committee (MSC) to adopt a new “philosophy” and a working 
approach for developing safety standards for passenger ships. In this approach, il- 
lustrated in Fig. 2.13 (SLF 47/48), modern safety expectations are expressed as a 
set of specific safety goals and objectives, addressing design (prevention), opera- 
tion (mitigation) and decision making in emergency situations with an overarching 
safety goal, commensurate with no loss of human life due to ship related accidents. 
The term “Safe Return to Port” has been widely adopted in discussing this frame- 
work, which addresses all the basic elements pre-requisite to quantifying the safety 
level (life-cycle risk) of a ship at sea. 
More specifically the following elements are explicitly addressed: 


1. Prevention/Protection: Emphasis must be placed on preventing the casualty 
from happening in the first place as well as on safeguards (in-built safety) to 
limit consequences. 

2. Timeline Development: The focus is clearly on the timeline development of dif- 
ferent events. For the first time in the history of rule-making, it is not only im- 
portant to know whether a vessel will survive a given casualty in a given loading 
condition and operating environment but also the time the vessel will remain hab- 
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Fig. 2.13 The IMO framework — passenger ship safety 
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Casualty Threshold Concept 


Casualty threshold is the extent of damage (flooding or fire) a ship is able to withstand and still safely return to port. 
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Fig. 2.14 Casualty threshold concept 


itable, the time it takes for safe and orderly abandonment and for recovery of the 
people onboard. 

3. Casualty Threshold: This advocates the fact that the ship should be designed for 
improved survivability so that, in the event of a casualty, persons can stay safely 
on board as the ship proceeds to port. In this respect and for design purposes 
(only), a casualty threshold needs to be defined whereby a ship suffering a ca- 
sualty below the defined threshold is expected to stay upright and afloat and be 
habitable for as long as necessary (5 days recommended) in order to return to 
port under its own power or wait for assistance (Fig. 2.14). 

4. Emergency Systems Availability/Evacuation and Rescue: Should a casualty 
threshold be exceeded the ship must remain stable and afloat for sufficiently long 
time to allow safe (3 hours recommended) and orderly evacuation (assembly, 
disembarkation and abandoning) of passengers and crew. Emergency systems 
availability to perform all requisite functions in any of the scenarios considered 
is, therefore, implicit in the framework. In addition, the ship should be crewed, 
equipped and have arrangements in place to ensure the health, safety, medical 
care and security of persons onboard in the area of operation, taking into ac- 
count climatic conditions and the availability of SAR functions and until more 
specialised assistance is available. 


Considering the above, it is worth emphasising that none of the questions aris- 
ing (survival time? functional availability post-casualty? time needed for abandon- 
ment?) can be addressed in terms of rule compliance. Nonetheless, achievement of 
these goals in the proposed holistic, goal-based and proactive approach would en- 
sure safety of human life commensurate with the safety expectations of today, by 
implicitly addressing all key elements of risk, for total risk (Safety Level) estima- 
tion and for direct use in RBD as explained in Sect. 2.2. An evaluation framework 
(Fig. 2.15, already being applied in the design of cruise/RoPax ships) and the ensu- 
ing scope of work are given next. The detail of this is considered in the next section. 
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Fig. 2.15 Risk-based design implementation (safety level) 


Availability Analysis 


2.1.3.1 Scope of Work 


Flooding survivability analysis: 


Compliance with SOLAS 2009 damage stability rules 

Vulnerability to flooding (dynamic ship survivability analysis) for all statisti- 
cally possible cases of collision and grounding 

Time to capsize 


Fire safety analysis: 


Fire risk screening of all spaces onboard (including special and external 
spaces) 

Vulnerability to representative fire scenarios (fire engineering analysis) 
Probabilistic evaluation of casualty threshold exceedance 


Post-accident (flooding or fire) system availability analysis 


Systems availability for each evaluated casualty scenario 
Quantification of residual functional capacity 
Probabilistic evaluation of Return to Port capability 


Evacuation and rescue analysis 


Quantitative risk assessment of the abandonment process 
Time necessary for abandonment in representative flooding scenarios and in 
critical fire scenarios 


2.1.4 Total Risk (Safety Level) 


A common way of presenting graphically the chance of a loss (risk) in terms of fatal- 
ities is by using the so-called F-N diagram, the plot of cumulative frequency of N or 
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more fatalities. However, while conceptually useful and, indeed, accepted widely as 
an expression of risk especially when plotted together with related criteria, (Skjong 
et al. 2005), it has been well known that for the purposes of consistent decision 
making, some form of aggregate information, derived on the basis of such distri- 
butions, is required. Commonly used summary statistics, such as expected value, 
are examples of such aggregate information. Unsurprisingly, the expected number 
of fatalities E(N), often referred to as the potential loss of life, PLL, has been used 
among the pertinent profession routinely. On this basis, an F-N diagram clearly im- 
plies that the risk to human life of a ship carrying more people is greater than that 
carrying a lesser number. However, this simple truth can be reversed if the bigger 
ship is designed to a higher safety standard/level. 

Arguably and with support from intuition, the bigger ship offers a better platform 
for achieving a higher safety level but intuition, conjecture or engineering judg- 
ment will not suffice when the argument concerns 10,000 human lives. All forms of 
knowledge must be called to play a role, provided that a comprehensive risk model 
and framework are available to calculate the total risk for a ship type (risk to human 
life for passenger ships). An attempt in this direction was presented in (Jasionowski 
and Vassalos 2006), and is outlined here in the following: 


Risk Model 
Nmax 


Riskpr, = E(N) = >) Fr (i) (2.1) 
i=l 


Where Nmax the maximum number of persons onboard and the Fy curve is given as: 


Nmax 


Fy (N) = > frw (i) (2.2) 
i=N 


The frequency fry(N) of occurrence of exactly N fatalities per ship year is mod- 


elled as follows: 
Nhz 


frn (N) = > fthz (hzj) + pr (N |hz;) (2.3) 
j=l 

Where, 7; is the number of loss scenarios considered, and hz; represents a loss 
scenario, identifiable by any of the principal hazards, the major of which as rec- 
ognized today are shown in Fig. 2.16. Furthermore, frj-(hz 7) is the frequency of 
occurrence of scenario hz; per ship year, and pry(N|hz;) is the probability of occur- 
rence of exactly N fatalities, given that loss scenario hz; has occurred. Shown also 
in Fig. 2.16 are estimates for the annual frequencies of occurrence for flooding- and 
fire-related hazards have been derived based on statistics, (Vanem and Skjong 2004). 
In addition, efforts in SAFEDOR (2005-2009) and elsewhere are ongoing aiming 
to derive these from first principles. With passenger ships, flooding- and fire-related 
scenarios comprise over 90% of the risk (regarding loss of life) and almost 100% of 
all the events leading to decisions to abandon ship. Therefore, it would be possible 
to estimate the total risk (safety level) of a passenger vessel by addressing these two 
principal hazards alone in a consistent manner and framework, allowing for their 
contribution to risk to be formally combined as indicated schematically in Fig. 2.15. 


36 D. Vassalos 


collision 


grounding 


0 0.002 0.004 0.006 0.008 0.01 0.012 0.014 


Frequency per Ship Year 


Fig. 2.16 Principal hazards — frequency of event occurring (cruise ships, [2.4]): hz;-flooding; 
hz2-fire 


Deriving from this, and as indicated in the foregoing, the following specific issues 
need to be addressed and are considered, next: 


Flooding survivability analysis (collision and grounding) 
Fire safety analysis 

Post-accident systems availability analysis 

Evacuation and rescue analysis 


2.1.4.1 Flooding Survivability Analysis 


Using the harmonised probabilistic rules for damage stability as basis, substan- 
tive elements of the risk model (Eq. (2.3)) have been developed, (Jasionowski and 
Vassalos 2006), as indicated next: 


3 "flood NHs 
pry (N\hzi)= > ¥ wie pj: Mek: cije (N) (2.4) 
i J k 
trait| | (N) 
| pOtpaitiz (NY) 
cije(N) = | —In(éij4)-(Gi,j4) 30 a) (2.5) 


Where, the terms w; and pj; are the probability mass functions of the 3 specific 
loading conditions and damage extents and n¢jo,q the number of flooding extents, 
respectively, calculated according to the harmonised probabilistic rules for ship sub- 
division, (SLF47/17 2004). The term e, is the probability mass function derived 
from the statistics of sea states recorded at the instant of collision and ny, is the 
number of sea states considered. The term c;,; 4 (NV) is the probability mass function 
of the event of capsizing in a time within which exactly N number of passengers 
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Fig. 2.17 Principal the concept of “capsize band”, (Jasionowski et al. 2004), for critical sea states 
of 0.5 and 4.0m 


fail to evacuate, conditional on events i, 7 and k occurring, and can be tentatively 
estimated from Eq. (2.5) based on the harmonised probabilistic rules; the formula- 
tion shown accounts for ship geometry, loading and each individual sea state in any 
given flooding event. The term €; ;,, (with o,-) represents the so-called capsize band 
shown in Fig. 2.17, that is the spread of sea states where the vessel might capsize. 
These can be estimated as follows: 


Hs, — HScrit (sij) ) 
&j,=1-© (2.6) 
uk ( 6; (HSerit (5i)) 
6, (H5¢rit) = 0.039 - HS crip + 0.049 (2.7) 


Where ® (.) is the cumulative standard normal distribution and Hs¢,iz (s) is given 
by Eq. (2.8) below, (Jasionowski and Vassalos, 2006): 


0.16 —In(—In(s 
AS crit (s) = AScollision (s) =~ 1 : ” 


(2.8) 


The s;; is the probability of survival, calculated according to (SLF47/17 2004). 


Ot fait (N) = trait (N) — tfait (N — 1) (2.9) 
trait (N) = Npgit (t) (2.10) 
Nyail (t) = Nimax — Nevac (t) (2.11) 


Finally, the term Neyac (t) is the number of passengers evacuated within time f, as 
shown below. 

As illustrated in Fig. 2.18, two parameters are of paramount importance in eval- 
uating risk meaningfully: the first is the time required for orderly evacuation of 
passengers and crew in any given event (Neyac(t)), derived from numerical simu- 
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Fig. 2.18 Interplay between time to capsize and evacuation time 


lations using advanced evacuation simulation software, (Vassalos et al. 2002); the 
second is the time to capsize/sink (¢-), which is evaluated by using two methods, as 
explained next. 

The time to capsize (t-), given a ship hull breach, is a random variable, (Vassa- 
los et al. 1998) hence only known as a distribution determined through probability 
methods Moreover, it is dependent upon a number of parameters (e.g. flooding con- 
dition, sea state, damage extent) all of which are also random in nature. In this 
respect, accounting only for the damage scenarios implicit in the new harmonised 
rules for damage stability (normally over 1,000 for a typical passenger ship) and 
considering the 3 loading conditions, also implicit in the rules, and some 10 sea 
states per damage case, it becomes readily obvious that brute-force time-domain 
simulations is not the “route to salvation’. In view of this, two lines of action are 
currently being pursued. The first relates to the development of a simple (inference) 
model for estimating the time to capsize, for any given collision damage scenario; 
the second entails automation of the process using Monte Carlo simulation, as out- 
lined next. 


Method 1 — Univariate Geometric Distribution — Collision 


Considerable effort has been expended over recent years to develop an analytical 
expression, which could replace the need for expensive numerical simulations, and 
still provide an overall description of the character of the stochastic process of ship 
capsize when subjected to collision damage in a seaway. Although not yet consid- 
ered to be as generic and comprehensive as the time-domain solution, a first pro- 
totype of such an engineering tool has been proposed in Jasionowski and Vassalos 
(2006) and Jasionowski et al. (2004, 2006), which is the model underlying Eq. (2.5). 
The inference model here is based on a geometric probability density distribution 
for time to capsize for each flooding scenario. Deriving from the above and shown 
here in Eqs. (2.12) and (2.13) is the probability density distribution for the time to 
capsize, using the same terms used in the probabilistic rules for damage stability, as 
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defined earlier: 


3 "flood NHs 
P(teap) — y By Wi* Pj > Ck: Ci,j k(tcap) (2.12) 
i of k 
Where fen 
Ci,j,k(tcap) = —In(&,j£) . (Eijk) “30/30 (2.13) 


Convergence between this expression and results from time-domain simulations 
provides the validation needed for typical damage cases, as shown in Fig. 2.19 fora 
typical cruise ship, and the confidence that this simple inference model, is capable 
of predicting the likelihood of a vessel to capsize in any given flooding scenario 
within given time in fractions of a second. This is a significant development. 

Considering all pertinent flooding scenarios for a typical ship, the outcome is the 
marginal cumulative probability distribution for time to capsize, shown in Fig. 2.20. 

A close examination of Figs. 2.19 and 2.20 reveals the following note worthy 
points: 

As a random variable, time to capsize can only be predicted in probabilistic 
terms. In other words, the deterministic number (3h) postulated at IMO is in- 
appropriate. The correct term should be “time to capsize within 3h with prob 
ability of x%”’. 

If a vessel did not capsize within the first hour post-accident, capsize is unlikely, 
on average. 

The marginal probability distributions for time to capsize tend to asymptotic val- 
ues defined by (1-A). 

Ability to estimate the probability of the time to capsize (in fractions of a second) 
could prove a very important tool to aid decision making in emergencies, particu- 
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Fig. 2.19 Cumulative probability function for time to capsize (scenario level) — comparison be- 
tween analytical model and numerical simulation results 
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Fig. 2.20 Cumulative marginal probability distribution for time to capsize within a given time for 
a ship 


larly when knowledge specific to the accident in question is accounted for and reso- 
lution of the model is enhanced by the time domain simulation results, shown next. 


Method 2 — Monte Carlo Simulation — Collision and Grounding 


To overcome problems associated with “averaging” (e.g., average probability of sur- 
vival) and other approximations and potential weaknesses that might be embedded 
in the formulation of the probabilistic rules, the random variables comprising load- 
ing conditions, sea states and damage characteristics (collision: location, length, 
height, penetration according to the damage statistics adopted in the probabilistic 
rules; grounding: location, length, height, width, as determined in-house (The Ship 
Stability Research Centre — SSRC) using statistics from the EU Project HARDER, 
(2003) are sampled using Monte Carlo sampling and each damage scenario is sim- 
ulated using explicit dynamic flooding simulation by PROTEUS3, (Jasionowski 
1997-2005). The resolution could be as high as necessary (every second of each 
scenario) accounting for transient- cross- and progressive-flooding, impact of multi- 
free surfaces, watertight and semi-watertight doors (relevant to passenger ships) and 
of course any damage scenario (collision, grounding, raking, etc.). Applications of 
this method indicate that 500 scenarios would be sufficient (for typical cruise ship / 
RoPax vessels the absolute sampling error for the cumulative probability of time to 
capsize derived was of the order of 4%—-5%). Examples of a Monte Carlo simula- 
tions setup are shown in Fig. 2.21 (generic) and Fig. 2.22, Fig. 2.23 for collision. 
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Fig. 2.21 Monte Carlo simulation — collision and grounding 


Typical results are shown in Figs. 2.20 and 2.24 as cumulative distribution func- 
tions of time to capsize within a given time. From the latter it will be seen that 
differences between the two methods of nearly an order of magnitude have been 
encountered and this led to renewed scrutiny of the probabilistic rules, as reported 
in (Vassalos and Jasionowski 2007). 
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Fig. 2.22 Monte Carlo simulation set up — collision 
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500 scenarios example 
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Fig. 2.23, Monte Carlo sampling — Length 
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Fig. 2.24 Probability distributions of time to capsize 
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2.1.4.2 Fire Safety Analysis 


Fire safety is currently dealt with through statutory means for established design 
solutions and through a performance-based approach for alternative design and ar- 
rangements not in line with prescriptive regulations. The latter is today undertaken 
in a manner consistent with ‘traditional’ risk assessment approaches. Whilst this 
takes place at qualitative level, in the first instance, quantitative analysis focuses 
thereafter on fire consequences (fire engineering) analysis for a limited number of 
representative scenarios. In this respect, the fire risk contribution to the total risk 
of a ship design is not being quantified and hence consistent risk summation is not 
possible for design, operation and regulatory purposes. In this respect and in the 
light of today’s trend for bigger, more complex and safer ships, it becomes obvi- 
ous that in addition to the current regulatory regime, a more systematic and rational 
design framework is needed to assist the design team to undertake pro-active fire 
risk screening as part of the early design iterations, in the same way as damage 
stability is addressed, so that better-informed decisions can be made when design 
decision-making is still cost-effective. This is particularly relevant when the design 
concept includes features that need to be evaluated under the alternative design and 
arrangements framework. 

It was in this context, that the idea of a similar formalised framework for fire 
safety was conceived during the SAFEDOR project (Guarin et al. 2007a), and its 
development supported with industry-funded projects. The primary goal in this un- 
dertaking was to achieve consistency in the way in which the risk associated with 
flooding and fire (the two main contributors to risk) onboard passenger ships is quan- 
tified and evaluated, as discussed in (Jasionowski and Vassalos 2006). This would 
allow risk quantification and evaluation to be carried out efficiently within the con- 
straints of the design process, one of the fundamental principles in risk-based design. 

This section presents the concept of a probabilistic framework for fire safety 
being developed along the lines of the probabilistic framework for damage stability 
to support the quantification of the overall ship safety level, as outlined next. 


Fire Risk Model 


Consistent with flooding, the risk associated with fire onboard a ship is quantified 
in terms of the frequency of statistical fatalities (societal risk) and is estimated by 
adding the risk contribution from each space onboard (Fig. 2.25), i.e.: 


Rr = y dR; dRi= fix ¥. (PR) Nix) (2.14) 
i=l k 


where n refers to the total number of spaces onboard, dR; is assumed to be asso- 
ciated with possible fire escalation outcomes, fire escalation (E) refers to failure to 
contain, control and suppress fire and explosion in the compartment of origin, (one 
of the main safety objectives implicit in SOLAS II-2), f; is the frequency of a fire 
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Fig. 2.25 Fire risk modelling 


scenario (i) and N;, the expected number of fatalities associated with all possible 
fire escalation outcomes (k), shown in Fig. 2.26. The frequency of fire occurrence 
in a space is a function of floor area and use of space. Fire escalation is evaluated 
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Fig. 2.26 Fire risk model for space (i) 
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Fig. 2.27 Fire risk model overview 


using various post-ignition models. The conditional probability of a fire escalation 
outcome P(E), largely depends on alarm, detection and suppression arrangements, 
fire growth potential and insulation class of boundaries. The associated number of 
fatalities N, depends on the number of people exposed to the resulting fire hazards; 
hence it depends on the use, occupancy profile and location of the space, the capac- 
ity and occupancy of the fire zone, as well as the evacuation arrangements. 

An overview of the fire risk model is presented in Fig. 2.27 next. 

Continuing from the above and in order to aggregate the risk contribution from 
fire and flooding, as explained earlier and shown in Eq. (2.2) the probability mass 
function for the resulting fatalities of an outcome (k) of scenario (i) has to be esti- 
mated. Given this and adopting the notation of Eq. (2.3), the frequency of occurrence 
of exactly N fatalities is then calculated as follows: 


frn(N) = ¥& [frnz(hz2)iP(k)i prn(N/hz2)e,i] (2.15) 
i=1 
n et Aki 

frn(N 2 fT nz(hz2)i PO (2.16) 


The parameter A is the mean number of fatalities and can be estimated from re- 
gression analysis of evacuation simulation results for typical configuration arrange- 
ments and standard scenarios (night and day). Consequently the FN curve associated 
with fire is calculated using Eq. (2.2) as individual risk contribution or in combina- 
tion with flooding risk. 

The components of the risk model described above and shown in Figs. 2.26 
and 2.27, were detailed in (Guarin et al. 2007b) and are briefly described next. 
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Fig. 2.28 Relative frequency of occurrence of fire incidents; 20% of space “uses” contribute to 
80% of all fire occurrences 


Fire Ignition Model. The ignition model is aimed at estimating the frequency of a 
fire ignition event fj. It has been shown (Guarin et al. 2007b) that the fire incidence 
rate for a specific ship space is influenced by the type or “use” of space, determining 
the contents of the space (materials, dimensions), presence of heat sources and ex- 
posure to a hazardous situation that could lead to fire. In a typical cruise vessel, for 
example, 50 space-“uses” were identified, as illustrated in Fig. 2.28 with the top-ten 
highest relative frequency of fire incidence. 

A review of available fire incident data onboard cruise vessels indicated that the 
most significant fuel sources include furnishings, floor, wall and ceiling coverings, 
fittings and other contents (e.g. oil and waste receptacles), which has been shown 
(Tillander 2004) to have a degree of correlation with the “floor area” of the spaces. In 
terms of heat sources the most significant include auto-ignition (stores), cigarettes, 
electrical (accommodation), hot surface (machinery, galleys), open flames (galleys), 
pyrotechnics (public), as well as hot work in crew and service spaces. The exposure 
to a hazardous situation depends on the exposure to different operational factors 
such as the level of occupancy, public/crew only access, time of the day, etc, all 
of which are associated with the actual “use” of the space. Hence, estimation of 
the frequency of ignition for a specific space type is based on the corresponding 
historical incidence rate per unit area, referred to as y;. Figure 2.29 illustrates the 
spaces with the top-ten highest values of y,;. Thus, the frequency of fire ignition in a 
specific space type of given area a; and “use” type, is calculated as follows: 


i=% Gi (2.17) 
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Fig. 2.29 Frequency of occurrence of fire incidents per unit area 


Post-Ignition Models. Post-ignition models are aimed at quantifying the prob- 
ability of fire escalation P(E) for a given scenario/space type (i), as illustrated in 
Fig. 2.30 and comprise the following: 

Failure of First-Aid (A): this addresses the probability of failure of first-aid fire 
suppression P(A), which would lead to fire growth and depends on the automatic 
and/or manual first-aid fire suppression arrangements. Successful first aid implies 
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Fig. 2.30 Simplified fire dynamics modelling 
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Fig. 2.31 Failure of first aid 


that the fire is not allowed to grow and the outcome of a fire event is only minor, 
ie., the fire does not escalate. Fire suppression first-aid failure can occur if fixed 
automatic and manual fire suppression failed. The corresponding failure model leads 
to Eq. (2.18) (see Fig. 2.31) for estimating the probability of first-aid failure: 


P(A) = P(A})- [P (Az) +P (A3) — P(A2) P(A3)] (2.18) 


Where, P(A;) is the probability of failure of the automatic (fixed) suppression 
system, P(Az) is the probability of failure of manual first-aid and P(A3) is the prob- 
ability of failure of first-aid by an on-duty staff (manual first aid using portable or 
available fixed system). As explained in (Guarin et al. 2007b), this is derived on the 
basis of empirical formulations, reliability of pertinent systems, experiential knowl- 
edge and data. 

The impact of first-aid on the rate of heat release from fire is illustrated in 
Fig. 2.32, showing that failure of any of these actions would result in fire growth 
to flashover situation. 
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Fig. 2.32 Impact of first-aid on fire energy time line 


2 Risk-Based Ship Design 49 


1200 200 » 
standard T curve 


ind 


1000 4 


Thous: 


800 4 


600 + 
standard T-t product 


deg C x min 


400 + 


Temperature, T (deg C) 


A-60 class: at t=60 min, average + 40 
| T at unexposed side of the 
bulkhead is ~160 degC 


200 + 


T 
0 60 120 180 


time, t (min) 


Fig. 2.33 Standard fire time line 


Failure of Insulation (B): this addresses the probability of insulation failure 
P(B) — due to failure of fire fighting, which is assumed to be equivalent to loss of 
containment. It depends on the fire growth potential of the contents in a given space, 
the timing and effectiveness of the fire fighting activities as well as the insulation 
class of boundaries. As explained in (Guarin et al. 2007b), failure of fire insulation 
of boundaries is evaluated in accordance with the performance criteria implicit in 
SOLAS regulation 3.2, 3.4 and 3.10 for insulation class A, B and C respectively. 
These criteria refer to the times at which the temperature at the unexposed side of 
the bulkhead exceeds certain limits. If the criteria are exceeded it is assumed that 
loss of containment, conditional to failure of first-aid, will occur. 

The standard times to failure, however, relate to the fire insulation performance in 
relation to the standard fire test. The standard temperature-time curve of the standard 
fire test is illustrated in Fig. 2.33. As can be seen, if the actual energy released by 
the fire, which is proportional to the temperature-time product (T-t) is known, then 
it is possible to estimate the time to failure for a bulkhead with any of the SOLAS 
standard class insulation types. 

As it can be implied from Fig. 2.33, the fire energy depends largely on the impact 
of fire fighting, which in turn is highly dependent on the time at which fire fighting 
is initiated. The time to fire-fighting is highly influenced by the alarm time and the 
time it takes for a fire fighting team to assemble and to reach the space of fire origin. 
Estimates are made on the basis of current cruise vessel experience. 

The probability of insulation breakdown (e.g. loss of containment) is calculated 
on the basis of the ratio (r) between the temperature-time product of the actual fire 
(including the heat release reduction due to fire fighting) and the standard fire test 
for a given insulation class. Since boundaries of a space can be of different bulkhead 
insulation class, the probability of failure corresponding to the lower boundary class 
is used for calculation of fire risk. 

Fire Spread into Adjacent Spaces (C): this model addresses the probability of fire 
ignition in an adjacent space P(C). It depends on the contents of the adjacent space 
and on the timing and effectiveness of boundary cooling (access and capacity) if 
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relevant. Fire spread into an adjacent space occurs when the temperature in any of 
the adjacent spaces due to heat transferred from the space of fire origin, reaches the 
flashpoint temperature (Tash) of its contents. The heat radiated from the boundary 
between the space of fire origin and an adjacent space, is proportional to the temper- 
ature Tgyp in the unexposed side of the bulkhead, which is determined by the type 
of insulation fitted and the released fire energy in the space of fire origin. In this 
respect, if the probability distribution functions of Tyas,h and TgHp are known (nor- 
mal distributions are assumed), then the probability of fire spread can be calculated, 
using standard reliability theory as follows: 


co 


P(C)= [F (Trass) f (Taup) dT (2.19) 
0 


The parameters of f(Tgup) and F (Thasn) are estimated on the basis of the average 
temperature in the space of fire and the flash temperature of the adjacent space con- 
tents, respectively. The probability of boundary cooling and its timing is estimated 
subjectively on the basis of expert opinion and available typical training patterns 
from the cruise industry. It is expected that this approach would give a conservative 
estimate of P(C) as heat radiation from the bulkhead in question and the location of 
the ignitable contents is not taken into account. 

Injury/Fatalities: this addresses the expected number of fatalities N for a given 
escalation outcome. It incorporates factors affecting the egress time of the occupants 
and the time to reach untenable conditions (due to smoke toxicity, heat and optical 
density) inside the space of fire origin and in spaces within the same fire zone. This 
is further elaborated in Sect. 4.4. 


2.1.4.3 Post-Accident Systems Availability Analysis 


In the knowledge that a significant number of accidents do not necessitate immediate 
evacuation from the ship, and in the event of such accidents, subject to meeting the 
basic needs of the occupants, the damaged ship may be taken to a nearby port or 
safe refuge. Similarly, many accidents can be mitigated and the ship can continue 
with her planned voyage. 

However, the quality allowing a ship to carry on following an accident can not 
be ensured incidentally. It has to be deliberately designed for. More specifically, 
in the knowledge that accidents lead to damage or destruction of onboard systems, 
and in order to withstand such consequences the overall design must have in-built 
redundancy from the point of view of a casualty, not only from the point of view of 
component reliability, which is the norm in designing for systems redundancy. 

However, “designing damage tolerant ship systems” is a far more complex prob- 
lem than one would initially imagine. Even though standard reliability engineering 
methods have been used in the evaluation of redundancy provisions, such methods 
rarely take into account the spatial “locality and historical frequency” of shipboard 
damage scenarios. Locality here implies the property that a damage scenario is more 
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likely to simultaneously affect systems that are located close together. Hence, if two 
systems that can stand in for each other are located far away from one another they 
provide a greater degree of robustness than they would if they were located side by 
side. This consideration is implicitly used in design and positioning of ship systems, 
but an explicit and quantitative treatment incorporating this property and damage in- 
cidence frequency will substantially enhance system availability in emergencies. In 
order to address this need, and with funding from SAFEDOR and the cruise ship 
industry, SSRC are in the process of developing and testing suitable computer soft- 
ware, so-called SAVANT (Systems Availability Analysis Tool — Fig. 2.34) to facil- 
itate probabilistic analysis of systems availability following the same probabilistic 
framework as in damage stability. 
SAVANT requires the following data for the said analysis: 


The spatial subdivision of the ship. 

The placement of the shipboard systems. 

The mutual interdependence of systems. 

Damage cases as defined for probabilistic damage stability analysis. 


The SAVANT system allows modelling of the functionality of the ship in terms 
of the way the functionality depends on other sub-functions and sub-systems within 
the ship. This dependency information is used in computing how systemic failure 
cascades in the event of an accident. This is illustrated in Fig. 2.35 (generic) and 
Fig. 2.36 (real data). 


Fig. 2.34 SAVANT modelling (example: compartmentation and systems) 


52 D. Vassalos 


Safe Return to 
Port 


Fig. 2.35 Systems dependency tree (generic construct for safe return to port function) 


SAVANT also uses the location and connectivity of the systems to determine 
which systems are directly affected by the immediate impact of an accident. If a 
single accident is considered in isolation, a given function either survives or fails. 
However, on aggregating over thousands of accident scenarios and weighing by the 
probability (or historical frequency) of each accident a probabilistic expectation is 
obtained of the failure of each function. In this regard, if p(j) is the probability of 
the jj, damage case as defined in SOLAS 2009, and g(F, /) is a function that takes 
the value one if the functionality F fails in the jg, damage case and zero otherwise, 
a probabilistic (failure) index can be defined for that functionality (much along the 
lines of Index of Subdivision A) as follows: 


N 
x Pl/)s(F, J) 


Fades = ———— (2.20) 


Monte-Carlo trials could also be used to accommodate probabilistic failure rates 
for flooded systems. However, to consider these developments in the context of risk 
and in line with the foregoing formulation, more resolution (information) is needed, 
namely the percentage of this functionality failure (residual functionality) over the 
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domain of the ship. In other words, if damage (j) occurred, what is the proportion 
of systems supporting the functionality (or what proportion of the functionality) is 
available. This is currently under development both within SAFEDOR and through 
industry-funded projects. On the basis of the influence of this development on the 
risk evaluation per se (from the point of view of LSA availability), this can be ac- 
commodated by introducing the following definition for t¢gjj); in Eq. (2.6). 


: t fail (N) 
l—p (Isa_systems_fail |damage ; ) 


tait\j (N) (2.21) 


2.1.4.4 Evacuation and Rescue Analysis 


The last element in addressing the issue of ship safety pertains to the evacuation 
process, Fig. 2.37. 

The IMO evacuation analysis, undertaken for new cruise ships and existing pas- 
senger ships on a voluntary basis, allows for assessment at the design stage of pas- 
sive safety (in-built) of the ship evacuation system only, while operational safety 
(active), pertaining to any measures to enhance emergency preparedness and to bet- 
ter manage crisis in case of an emergency, is only dealt with by means of a safety 
factor. In relation to this three issues need to be highlighted: 


(a) The IMO evacuation scenarios address issues relating to layout and availability of 
primary evacuation routes as well as passenger distribution and response times. 
These however, do not address any real emergencies and hence the need to pre- 
pare for such through better planning, training and decision support, all related 
to the functionality of the crew onboard, a factor as crucial to passenger mus- 
tering as a good layout of the escape routes. Breaking away from the traditional 
approach of the marine industry, Registro Italiano Navale (RINa) has developed 
a notation dedicated to operational aspects onboard ships with help from SSRC 
and implemented it on the Spirit Class of Carnival, (Dogliani et al. 2004). 

This Class Notation aims at assessing the effectiveness of crew functional- 
ity by comparing the evacuation performance of a ship in several specific sce- 
narios (in addition to the 4 IMO scenarios), pertaining to social events, ship at 
berth and owner specified scenarios to reflect real emergencies with and without 
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Fig. 2.37 The evacuation process 
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Fig. 2.38 Abandonment studies using Evi 


(b) 


(c) 


crew assistance. This new concept makes evacuation analysis much more rele- 
vant offering real “means” for enhancing passenger evacuation performance as 
well as incentivising passenger ship owners to improve emergency procedures. 
Stemming from these developments, evacuation analysis in emergency situations 
through numerical simulations can now be undertaken meaningfully. 
The term “Evacuation” tends to be used interchangeably with that of “Muster- 
ing” or “Assembly” and in so doing the crucial element of vessel abandonment 
tends to be overlooked. Emphasis on quantification of time to abandon cannot 
be stressed enough. As shown in Fig. 2.37, this would involve, in addition to the 
assembly process (including counting of passengers), embarkation (into lifeboats 
and MES), launching of lifeboats and clearing the vessel. 

All these would involve separate measurements using physical and numerical 
models (see Fig. 2.38). 
“Evacuability” post-accident, in addition to ensuring availability of emergency 
systems, the influence of floodwater/fire must be ascertained by using coupled 
flooding/fire evacuation models as described in (Vassalos 2006) and briefly out- 
lined next: 


Evacuation Analysis in Flooding Scenarios 


The output from PROTEUS3, including time histories of the vessel motions and 
accelerations, as well as floodwater mass, elevation and attitude in every modelled 
compartment of the ship, is incorporated into the evacuation model environment 
(Evi) as explicit semantic information concerning the effects of: deck inclination, 
ship motions and inaccessibility due to floodwater (Fig. 2.39). 


The simulation imports motion and flooding data, which is processed to give deck 


inclination to the horizontal (level) position. Using inclination, a correction factor is 
applied to the maximum walking speed of an evacuee (agent), based on the results 
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Fig. 2.39 Evacuation analysis — flooding scenarios 
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Fig. 2.40 Speed reduction factor due to effect of floodwater 


of research undertaken in the MEPDesign project — this has been described in detail 
in (Vassalos et al. 2002). Thus, flooding data is used to control the awareness and 
walking speed of agents, reducing it as they become more affected by (immersed 
into) the floodwater, as illustrated in Fig. 2.40, (Guarin et al. 2004). 


Evacuation Analysis in Fire Scenarios 


In fire scenarios, the number of injuries/fatalities associated with a specific fire sce- 
nario depends on the number of people exposed to the resulting fire hazards. 
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In this respect, it is well known that when evaluating the consequences of fire 
effluent to human life, the basic performance criterion states that the time required 
for escape, normally referred to as RSET (Required Safe Egress Time) should be 
shorter than the time available for the fire and smoke hazards to reach untenable 
conditions, normally referred to as ASET (Available Safe Egress Time), (Cooper 
2002). 

RSET < ASET 


The ASET is the interval between the time of ignition and the time at which 
conditions become untenable such that occupants can no longer take effective ac- 
tion to accomplish their own escape. Untenable conditions during fires may re- 
sult from inhalation of asphyxiant gases, exposure to radiant and convective heat 
and visual obscuration due to smoke. A quantitative approach to evaluate the 
above criterion was implemented by (Guarin et al. 2004, 2007a) and shown here 
in Fig. 2.41. 

Figure 2.42 illustrates an example of this assessment for a large public space. 
On the left hand side, a snap shot is shown of the time history of temperature cal- 
culated with a state-of-the-art field model (Guarin et al. 2007a). On the right hand 
side, egress simulations include a model for estimating the Fractional Effective Dose 
(FED) of heat of each occupant, based on the distribution of temperature in time and 
space. When the FED of an occupant exceeds the tenability criterion (FED > 1), the 
occupant can be assumed to be incapacitated. The same can be followed for toxicity 
and visibility evaluation. 

By adopting this approach, the actual human life loss is scenario-specific and is 
influenced by use of space, occupancy profile, and location of space within the main 
fire zone (MFZ) as well as the escape and evacuation arrangements. The criterion 
is evaluated in the space of fire origin and in spaces likely to be affected by smoke 
propagation within the same MFZ. 
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Fig. 2.41 Speed reduction factor due to fire hazards, based on conservative engineering judgement 
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Fig. 2.42 Left: temperature at 1.5m height from floor level for a large public space after 4 min 
from ignition (Horvat et al. 2007) Right: Human injury analyses for the same scenario (Guarin 
et al. 2007a) 


2.1.5 Concluding Remarks 


Based on the material presented in the foregoing, the following concluding remarks 
can be made: 


e A new philosophy on “Design for Safety” and the development of a RBD 
methodology enable ship safety to be dealt with in a systematic and all embrac- 
ing way by treating safety as an objective in the design process. RBD opens the 
door to innovation and offers competitive advantage to the maritime industry by 
facilitating cost-effective safety; without RBD optimal design solutions are not 
possible. 

e Insupport of the above the use of first-principles tools is highlighted and a work- 
able model presented for quantifying risk in passenger ships with regard to loss 
of human life. The integration of such tools allows for an explicit and direct eval- 
uation of human life loss in any given loss scenario. Such capability is essential 
if a “holistic approach” to ship design is to be adopted, particularly in relation to 
passenger ships (IMO Document SLF 47/8). 

e Such approaches reflect the trend toward goal-based standards and highlight the 
merits of a RBD methodology. This is particularly useful when dealing with in- 
novative ship design concepts and alternative design and arrangements. In such 
cases, quantitative risk analysis is the only reliable route to ensure that an appro- 
priate level of safety (equivalent to an acceptably low level of risk) and the set 
safety goals (e.g. safe return to port and “zero tolerance” to human life loss) are 
achieved. 
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2.2 RBD Case Story: Large Passenger Vessel 


Risk-Based Design (RBD) as a holistic process is by no means mature. However, 
applications of the underlying principles and tools are evident in ship design, from 
concept development to detailed design evaluation. By way of demonstration, risk 
containment of passenger ships will be addressed in the following under the premise 
that at any given time society must aspire to having passenger ships designed and 
operated at tolerable (zero tolerance is advocated by the current IMO Framework 
for passenger ship safety — SLF 47/48) and ALARP risk levels by fully utilising 
all available knowledge and tools in the design process. More specifically, this can 
be assured in the design stage by demonstrating that passenger and crew can be 
safely evacuated in all critical design scenarios (those scenarios where the Casu- 
alty Threshold is exceeded, necessitating safe and orderly abandonment of passen- 
gers and crew). This can be achieved by addressing the risk of fire and flooding, 
the two principal accident categories, which as indicated in the foregoing, account 
for more than 90% of total risk and being responsible for 100% of all passenger 
ship abandonment cases. RBD can be approached in its simplest form of applica- 
tion (namely tackling a novel concept on the basis of equivalent safety at scenario 
level — Alternative Design and Arrangements) or at its fully fledged “glory” tackling 
all design scenarios for all pertinent accident categories and using risk summation 
to evaluate the safety level of the novel concept design. In either case, the three 
pertinent issues to be considered involve Evacuation (advanced evacuation simula- 
tion is a pre-requisite tool in assessing risk to human life), Flooding and Fire Risk 
Assessment using proprietary or publically available safety-performance prediction 
(first-principles) tools. In this chapter, these building blocks of RBD will be ad- 
dressed first, before demonstrating the implementation of the proposed methodol- 
ogy by presenting design iteration at ship level. The material presented here needs to 
be considered in conjunction with the material in the Risk-Based Design Overview. 


2.2.1 Building Blocks of Risk-Based Design 


2.2.1.1 Advanced Evacuation Simulation 


The process of evacuating a large passenger ship is very complex, not least be- 
cause it involves the management of a large number of people on a complex moving 
platform, of which they normally have very little knowledge. These characteristics 
make ship evacuation quite different to evacuation from airplanes and buildings. To 
address the risk associated with passengers and crew at sea, the term Evacuabil- 
ity (passenger evacuation performance capability) has been devised, (Vassalos et al. 
2002), entailing a wide range of capabilities that encompass evacuation time, iden- 
tification of potential bottlenecks, assessment of layout, life saving appliances, pas- 
senger familiarisation with a ship’s environment, crew training, effective evacuation 
procedures/strategies, intelligent decision support systems for crisis management 
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and design for ease of evacuation. From a technical point of view, the mass evacua- 
tion of thousands of people from an extremely complex environment with unknown 
inaccessibility problems exacerbated by (potentially co-existing) hazards such as 
floodwater and fire/smoke and the inherent uncertainty deriving from unpredictabil- 
ity of human behaviour in a crisis situation, is a problem with severe modelling 
difficulties at system, procedural and behavioural levels. 

Evacuation has been a high priority in the International Maritime Organisation’s 
(IMO) Agenda since 1999 when SOLAS imposed evacuation analysis to be carried 
out early in the design stage of new Ro-Ro passenger ships. Following this, the Fire 
Protection Sub-Committee, after three years of work, issued in February 2002 a set 
of revised Interim Guidelines for new Ro-Ro passenger ships — new cruise ships and 
existing ships on a voluntary basis — to be carried out either by simplified analysis 
or computer-based advanced analysis. Such analysis allows for assessment at the 
design stage of passive safety (in-built) of the ship evacuation system only, while 
operational safety (active), pertaining to any measures to enhance emergency pre- 
paredness and to better manage crisis in case of an emergency, is only dealt with by 
means of a safety factor. In this respect, the IMO evacuation scenarios address is- 
sues relating to layout and availability of primary escape routes as well as passenger 
distribution and response times but does not address any real emergencies and hence 
the need to prepare for these trough better planning, training and decision support, 
all related to the functionality of the crew onboard, which is as crucial to passen- 
ger assembly as a good layout of the escape routes. To address this issue, RINa has 
developed and launched the first ever notation dedicated to operational aspects with 
help from the Ship Stability Research Centre (SSRC) and implemented it on the 
Spirit Class of Carnival, (Dogliani et al. 2004). 

This Class Notation aims at assessing the effectiveness of crew functionality by 
comparing the evacuation performance of a ship in several specific scenarios (in ad- 
dition to 4 IMO scenarios) pertaining to social events, ship at berth and owner spec- 
ified scenarios to reflect real emergencies with and without crew assistance. This 
new concept makes evacuation analysis much more relevant offering real “means” 
for enhancing passenger evacuation performance as well as incentivising passenger 
ship owners to improve emergency procedures. 

Stemming from these developments, evacuation analysis through numerical sim- 
ulations can now be undertaken meaningfully. In this respect, the term Evacuabil- 
ity reflects ability to evacuate a “ship environment” within “a given time” (time to 
sink/capsize) and for “given initial conditions” and is defined as follows (Fig. 2.43): 


E=f {env,d,r(t),s[evacplan,crew,mii(g,y,hci)];t} 


More specifically, Evacuability is a function of a set of initial conditions, env, 
d and r(t), and evacuation dynamics, s(n;) (where n; describes all pertinent proce- 
dural and behavioural factors), directly related to and deriving from a loss scenario 
and provides a direct measure of risk to human life in a ship-sea environment as 
explained in (Dogliani et al. 2004). 
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Fig. 2.43 The concept of Evacuability (E) 


On the basis of the above, it may be stated that Evacuability is a well-defined 
problem that can be formulated and solved (simulated) for a given loss scenario, 
given initial conditions and passenger flow parameters. In fact, there exist several 
advanced passenger evacuation simulation tools, some of which are able to deal 
with design and operational issues as well as be coupled with other advanced pre- 
diction tools for flooding (e.g., PROTEUS3 — (Jasionowski 1997-2005) and fire 
(e.g., REUME — Guarin et al. 2007b), and be utilised to prevent/reduce risk to human 
life, as postulated in the foregoing. Evi (the SSRC advanced evacuation simulation 
tool), for example, uniquely incorporates capabilities to estimate the effects of both 
fire and flooding loss scenarios in the evacuation process. In the cases considered, 
data from external tools that address flooding and fire hazards independently (out- 
side the evacuation simulation environment) is required. This data is then imported 
into Evi as additional semantic information for the agents (evacuees). The agent 
model considers human behaviour for a small set of crucial characteristics such as 
speed and awareness. A hazard within the evacuation simulation environment will 
affect these characteristics by changing the performance of the agents. 


2.2.1.2 Flooding Risk Assessment 

Background 

Collision and grounding/stranding are the largest contributors to the risk of sink- 
age/capsize for passenger-carrying vessels. The probability of survival and even- 


tually the time to sink/capsize are crucial factors in determining the actual level 
of safety of a ship design. Whilst the former can be reasonably estimated using 
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empirical methods, the latter (time to sink/capsize) strongly depends on the geom- 
etry, topology and status of the internal compartmentation and openings (including 
doors, ducts, valves, etc) in addition to the random sea environment. 

The dynamic response of a damaged vessel, and the progression of floodwater 
through it in a random seaway form a highly non-linear dynamic system, the be- 
haviour of which can only be assessed through time domain simulation. Building 
on this view, the University of Strathclyde began to develop the first-ever numerical 
model of this kind over 25 years ago. Since then, this model has been amply vali- 
dated and calibrated through its application in both research and consulting work, 
before arriving at its current version, PROTEUS3. This software suite is capable 
of simulating the vessel’s behaviour (6-dof motions at zero or forward speed of in- 
tact or damaged ships, the latter of single or multiple compartment configuration) 
as well as the evolution of transient and progressive flooding through any damage 
compartment configuration and any shape and position of openings through which 
flooding takes place. In addition, a number of non-linear effects can be incorporated, 
such as wave generated drift, wind loading, dynamic effects of cargo shifting, im- 
pulsive excitation and mooring forces, among others. In PROTEUS3, the complex 
behaviour of floodwater is modelled with a simplified method, developed as an alter- 
native to RANSE CFD techniques. This technique derives from an approximation of 
floodwater transfer by pendulum-like movement driven by ship-motion-related/ 
gravity acceleration field and constrained by internal compartment geometry on one 
hand and undisturbed floodwater free surface on the other. Thus, fully non-linear 
interactions between the ship and floodwater, treated as two interdependent, albeit 
separate, dynamical systems is represented meaningfully and with sufficient engi- 
neering accuracy. The output from PROTEUS3, including time histories of the ves- 
sel motions and accelerations, as well as floodwater mass, elevation and attitude in 
every modelled compartment of the ship, is incorporated into the evacuation simula- 
tion environment (Evi) as explicit semantic information with the following effects: 


e Deck inclination: Asymmetric flooding will heel the ship making it more difficult 
to walk and reducing the speed of agents; 

e Ship Motions: Dynamic motions will affect peoples’ orientation and movement 
capabilities, consequently, agents will move more slowly, make wrong decisions 
or may fall over; 

e Inaccessibility: Flooding will make some areas of the ship inaccessible. This 
means that for people on lower decks certain evacuation routes may become 
unavailable. 


The simulation imports motion and flooding data, which is processed to give deck 
inclination to the horizontal (level) position. Using inclination as input, a correction 
factor is applied to the maximum walking speed of an evacuee based on results of 
research undertaken in the EU FP4 MEPDesign project — this has been described 
in detail in (Guarin et al. 2004). Thus, flooding data is used to control the aware- 
ness and walking speed of agents, reducing it as they become more affected by the 
floodwater, as illustrated earlier in Fig. 2.40. 

All the above-listed effects, would affect the time needed for orderly assembly 
and eventually, the time needed for safe evacuation of all people on board. There- 
fore, for any predetermined flooding scenario, the integrated simulation environment 
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offers the means to evaluate set safety objectives. If these were not met, the effec- 
tiveness of potential solutions could be evaluated until an acceptable solution was 
found. This iterative process, allowing for a direct link between a given scenario and 
risk, in terms of pertinent parameters affecting frequency and consequences, hence 
risk prevention/reduction, affords an effective way of “de-risking” a passenger ship 
from collision/grounding risks. 


Flooding Design Scenario 


Containment of collision M flooding risk has recently been advanced to a stage at 
least comparable to that of fire, particularly so with the development of harmonised 
regulations for damage stability calculations (SOLAS 2009). The relevant design it- 
eration is shown in Fig. 2.44. In the process depicted in (Vassalos 2004), it is implied 
that if a collision damage case is “critical” (i.e. likely and probably non-survivable), 
there should be made an effort to find solutions (RCOs) to prevent the vessel from 
capsizing/sinking. These solutions may be of local and/or global character, enabling 
the vessel to survive in a “habitable” manner whilst waiting for help or to reach a 
port of safe refuge (SLF 47/48). When finding cost-effective solutions to survive 
collision damage passively becomes difficult (i.e. when the “damage threshold” has 
been exceeded) then the focus might shift to mitigating the ensuing risk to human 
life. This entails ensuring that all people onboard can be evacuated safely. In this 
sense, the expected time to capsize should be evaluated in conjunction with the 
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Fig. 2.44 Design iteration for collision damage (flooding scenarios) 
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expected time needed for evacuation. If this assertion can be demonstrated (through 
simulation using first-principles tools), then the risk implicit in the resulting design 
concept could be rendered as low as best knowledge available permits. This ap- 
proach demonstrates that ship safety, ultimately risk to human life, can be evaluated 
explicitly and more rationally than just by following the rules. 

Figure 2.45 presents schematically typical probability curves for time to cap- 
size/sink and for surviving a given sea state (represented by significant wave height, 
Hs) corresponding to a damaged vessel subjected to progressive flooding as a func- 
tion of loading condition (represented by metacentric height -GM- and freeboard). 

Figure 2.46 illustrates the evaluation of potential loss of life through passen- 
ger evacuation advanced simulation tools, taking as input the available time to 
sink/capsize deriving from flooding survivability analysis. The figure shows a typi- 
cal passenger objective completion curve and the quantification of the ensuing risk 
in terms of potential loss of human life (shaded area). 

Deriving from the probabilistic rules for damage stability (SOLAS 2009) and 
building on the elements comprising Index-A, affords a way of identifying the 
relative risk contribution of each collision M flooding scenario at an early design 
stage and hence devise an effective means of risk reduction by focusing primarily 
on the high risk-contributing loss scenarios. This concept is illustrated in Fig. 2.48 
for a RoPax vessel (this is an actual study case). In this figure, a point on the hor- 
izontal axis corresponds to the mid coordinate of the flooded compartments. The 
“relative risk” of non-survival, p;- (1 —;), is plotted on the vertical axis. For a spe- 
cific damage location, there may be several damage case scenarios depending on 
the extent of flooding (longitudinally, vertically and transversely). The non-survival 
probability (relative risk) can be used to identify high-risk areas of the watertight 
subdivision; design changes in those areas will be the most effective in reducing 
risk, and of course in improving the subdivision index. This goal can be approached 
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Fig. 2.45 Consequence analysis of a flooding loss scenario (time to capsize) 
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Fig. 2.46 Consequence analysis of flooding loss scenario (risk quantification) 


either at scenario or at ship level, the latter by setting up an optimisation problem as 
explained in the following section. 

The flooding design scenario presented here is a night time scenario focusing 
on an existing large passenger Ro-Ro vessel with 2502 passengers and 190 crew, 
which at her current configuration achieves an Attained Subdivision Index of A = 
0.751, whilst the Required Index has a value of R = 0.821. This means that an 
improvement of AA = 0.07 is needed for the vessel to comply with the probabilistic 
rules. Figure 2.47 illustrates the cumulative curve of the quantity p.v.(1 — s) (where 
“v” is a factor limiting vertical extent above the waterline) for all damage cases 
calculated for this vessel. It shows that in order to achieve the improvement AA = 
0.07 to ensure compliance, i.e., A > R, all damage cases with p.v.(1-s) > 0.0048 
need to be addressed. 

The longitudinal location of all damage cases with s < | — damage scenarios 
with p.v.(1 — s) above 0.0048 — represent critical scenarios with high likelihood 
in terms of p; and low survivability in terms of (1 —s;). This analysis shows that 
there are 12 cases with the highest potential to improve A (if “s” is made equal 
to 1 for these cases, then A will be exactly equal to R). The longitudinal location 
of these damage cases is illustrated in Fig. 2.48. It should be noted that all critical 
damage cases are either two- or three-compartment damages (7 two-compartment 
and 5 three-compartment), hence cases that known design measures can be applied 
for improving the vessel survivability. It goes without saying that it might be more 
cost-effective to deal with, say, all two compartment damages even if their relative 
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Fig. 2.47 Cumulative dA(risk) for selection of critical damage cases 
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Fig. 2.48 Identification of critical design scenarios (basis ship) 


risk contribution is less than the aforementioned value but it makes good sense to 
focus on high risk areas from top down. 

The simplest way to proceed from here is 0 consider individually critical design 
scenarios (if only a limited number should be examined) with a view to assessing 
and negating potential loss of human life trough local design measures (RCOs — such 
as partial bulkheads, subdivision of side casings, void tanks, double hill and so on). 
To this end, survivability and time evolution of non-survivable scenarios need to be 
addressed, followed by assessment of Evacuability for the latter to allow the designer 
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Fig. 2.49 Time evolution of the collision damage scenario 


to identify and rank RCOs based on cost-effectiveness. From Fig. 2.48 it would appear 
that the most “risky” scenario is engine room damage — compartments 3-4). Using 
IMO Demographics (Vassalos et al. 2003), results from Evi show that after 3 1 min only 
2,281 passengers will have abandoned ship, thus leaving 411 passengers in assembly 
stations (potential casualties). This is, of course, unacceptable and hence cost-effective 
preventive and mitigating measures need to be identified to contain risk, as explained 
in Fig. 2.44. The time evolution of this scenario and the effect that it would have on 
passenger evacuation, hence the ensuing risk, are shown in Fig. 2.49 below. 

The optimum local solution identified to address this critical flooding scenario 
comprises a local repositioning of transverse bulkheads together with 1.2m double 
hull in the engine room, up to the subdivision deck. It is interesting to note that 
using this solution alone results in Index-A of 0.823 (R = 0.821), hence compliance 
with the rules. A number of critical scenarios, however, as shown in Fig. 2.50, still 
remain critical. In addition, a close examination of Fig. 2.50 helps to demonstrate 
that even local small changes on a ship may have a wider and profound effect; hence 
considering isolated scenarios and equivalent safety might lead to overlooking the 
wide-ranging influence that invariably these changes have on the ship as a whole. 
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Fig. 2.50 Identification of critical design scenarios (design solution 1) 
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2.2.1.3 Fire Risk Assessment 
Background 


Despite the fact that prevention and mitigation of the most common fire events on- 
board ships are extensively addressed by current prescriptive regulations, fire con- 
tinues to be one of the major hazards to ship operations. Currently, fire safety in 
ship design is addressed through compliance with prescriptive SOLAS regulations, 
dealing with issues of prevention, suppression and escape, among others. These 
regulations have a major impact on the resulting designs, in terms of layout, func- 
tionality and costs, in some cases inhibiting development of innovative, equally safe 
but potentially more cost-effective and more lucrative solutions. Such issues are im- 
portant in all sectors of the maritime industry today. At the same time, the increased 
level of understanding of fire physics and of the influence of fire hazards on hu- 
man behaviour as well as advances in fire modelling have encouraged the use of 
performance-based design codes d in the maritime industry. 

In fact, the adoption of the provisions for alternative design & arrangements for 
fire safety MO, 2006) heralded the beginning of risk-based design and regulation 
and the advent of indoor promenades and atria in passenger ship design. This is 
reflected in the new SOLAS Ch. I-2/Regulation 17 (SOLAS 2004), which allows 
the use of performance-based fire engineering methods to demonstrate that design 
solutions not complying with some of the prescriptive regulations are as safe as an 
equivalent prescriptive design. This approach is commonly referred to as the “equiv- 
alence” principle, according to which the design solution, referred to as an “alter- 
native” design, is set to achieve the same fire safety objectives and comply with 
the same functional requirements as an equivalent prescriptive design. Despite be- 
ing more time consuming and expensive than the traditional prescriptive approach, 
performance-based ship design may lead to potentially safer, innovative, attractive 
and more cost-effective design solutions. Available statistics, for instance (Mather 
and Strang 1997), indicate that more than 60% of all fire casualties occur in gen- 
eral cargo ships, bulk carriers and oil tankers. Passenger ships (including RoPax) 
account for just 6% of all fire incidents. In spite of this, high numbers of people car- 
ried on board put newer passenger ships at significant risk of life loss (in relation to 
other ship types) arising from fire. Moreover, current trends in ship design suggest 
that alternative design solutions developed with performance-based methods for fire 
safety will be a feature mainly of passenger ships; hence the focus on fire safety 
from the point of view of passenger survival alone. 

Even though experience with the use of alternative design for fire safety is be- 
ing amassed, it has not yet become routine and there are good reasons for this: 
prescriptive design is easier (specific training is not needed), and fire-engineering 
tools are neither easily available nor easy to use; hence such studies are normally 
performed by specialist consultants. However, as far as passenger ships are con- 
cerned, there are many potential areas for exploiting benefits of alternative design 
(large internal promenades, larger than currently permitted public spaces, alternative 
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ventilation strategies, alternative escape and evacuation arrangements, parks, the- 
atres, atria, multi-storey restaurants and so on). 

For these cases, the performance criteria are associated with safety of human 
life and mitigation of material damage to the ship for a specified fire event. Thus, 
parameters describing the hazards associated with fires (such as temperature, heat 
fluxes, toxic contamination and visibility obscuration) must be predicted with suf- 
ficient accuracy for large and small spaces of simple and non-standard geometries, 
e.g. with large horizontal or vertical dimensions (corridors, vehicle decks, staircases, 
atria, engine rooms). On the other hand, the level of uncertainty in the associated pa- 
rameters necessitates that variational studies be conducted to ascertain the level of 
sensitivity of the results. Thus fire-engineering tools must be able to provide quick 
solutions even for large applications, ranging from few spaces to complete vertical 
fire zones spanning several decks. In terms of alternative design and arrangements 
for fire safety as stated in SOLAS Regulation 17, the use of consequence-analysis 
tools in conjunction with appropriate criteria for evaluating human life safety is es- 
sential, as explained next. 

It is well established that when evaluating the consequences of fire effluent to 
human life, the crucial criterion for life safety is that the time available for escape 
from a ship space should be greater than the time required for safe evacuation of 
occupants. The time available for escape is the interval between the time of ignition 
and the time for conditions to become untenable such that occupants can no longer 
take effective action to accomplish their own escape. Untenable conditions during 
fires may result from: 


e Inhalation of asphyxiant gases: these may cause loss of consciousness and ulti- 
mately death resulting from hypoxic effects, particularly on the central nervous 
and cardiovascular systems, 

Exposure to radiant and convective heat, and 
Visual obscuration due to smoke. 


The above represent the fire hazards and can be imported and distributed in time 
and space into the evacuation environment (Evi) as explicit semantic information 
for the agents, much the same as in the case of flooding scenarios. These include 
concentrations of CO, CO2 and Oo, as well as Temperature, Radiant Heat Flux and 
Optical Density directly affecting —at each time step— the awareness and walking 
speed of the evacuees (agents). In order to estimate the effect of the fire hazards, an 
approach presented in (Purser 2002) is adopted based on the concept of Fractional 
Effective Dose (FED, for toxicity and heat) and Fractional Effective Concentration 
(FEC, for visibility). The FED and FEC are values indicating the human vulnerabil- 
ity to the cumulative effects of exposure to heat and toxic gases as well as the level 
of visibility in a space. Their values are calculated for each agent individually and 
are used to control walking speed and awareness and determine the point at which 
an agent becomes fatally injured, as mentioned earlier and illustrated in Fig. 2.41. 

Once again, by linking a given fire scenario to the ensuing risk directly through 
pertinent parameters affecting risk prevention/reduction, cost-effective solutions can 
be identified to “de-risk” passenger ships from fire risk. 
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Fire Design Scenario 


In this case a fire design scenario is selected to demonstrate fire risk assessment 
and containment by using an alternative design and the principle of “Equivalent 
Safety”. SOLAS Ch. H-2.24 states that a main vertical fire zone (MVZ) should not 
be of greater length than 48 m (to coincide with watertight subdivision bulkheads). 
In order to incorporate larger public areas, one is allowed to design beyond this 
length provided that the total area of the public space does not exceed 1,600m? 
(the latter could also be tackled similarly). In July 2002, SOLAS regulation [-2/17 
(MSC/Circ.1002) was adopted, which allows designs not strictly complying with 
the existing prescriptive fire safety regulations to be accepted provided such designs 
can be shown to be at least as safe as the design made in accordance with the IMO 
rules. This allows modern passenger vessel designs to go beyond the fire safety 
limits in order to create more inviting and exciting passenger spaces. The iteration 
to be followed is illustrated in Fig. 2.51, whilst the scenario being addressed here is 
described in Table 2.1 and illustrated in Fig. 2.52. 
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Fig. 2.51 Alternative design and arrangements iteration for fire safety 


Table 2.1 Restaurant design parameters — 48 and 60 m restaurant designs 


Restaurant design Prescriptive Alternative design 
Length 48m 60m 
Capacity Lower deck 750 pax 690 pax 
Upper deck 550 pax 960 pax 
Total 1,300 pax 1,650 pax 
Total exits’ width Lower deck 9.4m 11.4m 
Upper deck 10.8m 10.8m 
Floor area Lower deck 1, 154m? 1,872 m? 


Upper deck 1,497 m? 1,748 m? 
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lower deck | 


Fig. 2.52 Alternative design approach — upper and lower Decks of a 60 m restaurant 


In the scenario considered, the fire ignites at the forward starboard end of the 
lower deck as illustrated in Fig. 2.53. Smoke propagates through the forward end of 
this deck and up through the central opening to the upper deck. 

To determine the risk quantitatively, frequency (f;) and consequences (c;) for 
the scenario in question need to be estimated. In a general case, accident/incident 
statistics may be used for frequency estimation but in this particular case where an 
alternative design is considered only consequences will be used to quantify risk. The 
consequences are quantified on the basis of the number of injuries/fatalities and/or 
the expected damage to equipment and/or ship. The metric for risk calculation is 
defined a priory, consistently with an appropriate risk criterion. The number of in- 
juries/fatalities is obtained from evacuation simulations using Evi in conjunction 
with output from fire engineering calculations using REUME. The latter is employed 
to assess the development of fire and smoke in the restaurant arrangement, and the 


smoke propagation 


fire source 


Fig. 2.53 Alternative design approach — illustration of fire and smoke through the lower and upper 
decks of the restaurant 
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Fig. 2.54 Alternative design approach — exits blocked by fire 


resulting distribution of fire hazards (quantified in terms of toxicity, visibility and 
heat) appropriately incorporated into Evi (Fig. 2.54). 

The number of fatalities depends on the time to egress from the respective spaces 
(output from Evi) and the time to reach untenable conditions in these spaces, in 
terms of toxicity, visibility and heat. According to the risk metric used, appropriate 
risk acceptability criteria can be defined and hence the risk level evaluated against 
selected criteria as explained in the foregoing. If the risk level is not acceptable 
for any one evaluated scenario, potential RCOs will be evaluated based on cost- 
effectiveness analysis. In the scenario considered, smoke originates at the lower 
deck, starboard side forward of the restaurant and spreads to upper deck with un- 
tenable conditions (UC) being reached within 4—5 min. The fire blocks the primary 
escape route at the forward end of the restaurant and passengers have to use al- 
ternative (secondary escape) routes. This increases congestion and causes the total 
egress time to increase. In this respect, the egress time ought to be compared with 
the time required for conditions to become untenable as a means of assessing the 
ensuing risk. Table 2.2 and Figs. 2.55, 2.56 and 2.57 show the results deriving from 
evacuation and smoke spreading simulations. 

The results clearly demonstrate unacceptable consequences and hence the need 
to contain the risk associated with the fire scenario being considered. To this end, 


Table 2.2 Alternative design (ALT 1) — consequences analyses 


Spaces Egress time TimetoreachUC _ No. of passengers affected 


Upper deck 7-8 min 4-5 min 28 (~ 4%) 
Lower deck 8-9 min 4-5 min 50 (~ 5%) 
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Fig. 2.55 Non-fire scenario — comparison between alternative and prescriptive designs 
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Fig. 2.56 Alternative design — normal vs. fire scenario 


a number of RCOs were considered, the most cost-effective of which include the 


following: 


e Increasing the number of smoke extraction fans from 2 to 4 
e Increasing the number of inlet air fans from 2 to 4 
e Widening escape ways 


Following implementation of the aforementioned RCOs, the ensuing conse- 


quences are now as shown in Table 2.3 and hence acceptable. 
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Fig. 2.57 Prescriptive design — evacuability — normal vs. fire scenario 


Table 2.3 Alternative design (ALT 2) — consequences analyses 


Spaces Egress time Time to reach UC No. of passengers affected 
Upper deck 5-7 min 8-9 min 0 
Lower deck 6-7 min 8-9 min 0 


2.2.2 Early Implementation Results 


In this section, some early results will be presented aiming to provide answers and 
clarity to concepts pertaining to RBD implementation regarding evaluation of a 
ship’s safety level. To this end, a hypothetical cruise ship is used with the following 
particulars: 

The subdivision layout is shown in Fig. 2.61. Reference is made to the safety 
level evaluation framework, Fig. 2.15 and the ensuing scope of work that was intro- 
duced in RBD Overview. 


2.2.2.1 Flooding Survivability Analysis 

Flooding survivability analysis normally entails the following, which are addressed 
here at various levels of detail. 

e Statutory Assessment 


— Compliance with SOLAS 2009 (probabilistic rules) 
— Optimisation of watertight subdivision 
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e Transient-, cross- and progressive-flooding assessment 


— Static vs. dynamic stability 
— Time to flood 


e Time to Capsize 


— Probabilistic approach for selection of damage (collision and grounding) cases 
— Vulnerability approach for survivability assessment 


e Systems availability for each flooding scenario 
— Geometrical and topological evaluation of main ship systems 
e Evacuability assessment 


— Assembly and evacuation performance 
— Assessment of time to capsize against total evacuation time 


e Evaluation of casualty threshold/return to port capability 


— Probabilistic approach; link to system availability post-casualty 


Statutory Assessment 


Acknowledging that emphasis on preventing a casualty from occurring in the first 
instance must take priority, focus on risk reduction by passive means (in-built safety) 
must come next and this must start at the beginning. To this end, the dilemma of 
prescriptive SOLAS-minded designers, illustrated in Fig. 2.58, in the simplest of 
levels, must be overcome. It is obvious that internal subdivision arrangement is a 
key issue affecting ship performance, functionality and safety, all of which have to 
date been catered for through the provision of rules and regulations that reflect, in 
essence, codification of best practice. Throwing this away and leaving on the table 
a blank sheet, makes ship subdivision a very difficult problem indeed. This was 
essentially the problem addressed in the EU project ROROPROB, (ROROPROB 
1999-2002). 

Building on the understanding of Index-A as outlined in Sect. 3.1, affords a 
straightforward way of determining the relative collision M flooding risk profile of a 
vessel at an early design stage and hence devise an effective means of risk reduction 
by focusing primarily on the high risk scenarios. 

The fully automated optimisation process typically produces several hundred de- 
sign alternatives depending on the complexity of the ship’s layout and the number 
of variables. Typical variables of the optimisation problem include: type of subdi- 
vision, number, location and height of watertight bulkheads, deck heights, tank ar- 
rangement, casings, double hull, and position of staircases, lifts and escape routes. 
Using the Attained Subdivision Index, payload capacity, steel weight and other 
regulatory requirements as typical objectives/constraints, the optimisation problem 
outcome typically includes: reduced number of bulkheads, reduced deck heights, 
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Fig. 2.58 Largely “unguided” subdivision (probabilistic rules) 


reduced void volume, reduced number of escape ways and required staircases, re- 
duced steel weight, reduced complexity in tank arrangements, increased crew and 
service areas, improved functionality and, if required, improved Attained Subdi- 
vision Index. In order to make the process effective, participation by all decision- 
makers (designer, owner and yard) is essential to properly define the optimisation 
variables, objectives and constraints as early as possible in the design stage. Us- 
ing this approach, known as “platform optimisation”, high survivability internal 
ship layouts can be developed, without deviating much from the current SOLAS 
practice, this making it easier for ship designers to relate to the proposed proce- 
dure. The actual process for platform optimisation as it is currently being applied to 
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Fig. 2.59 Platform optimisation process 
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Fig. 2.60 Platform optimisation process — concept designs 


newbuildings design is illustrated in Fig. 2.59. A sample of the optimisation problem 
outcome is presented in Fig. 2.60. 

Using the hypothetical cruise vessel of Table 2.4 and Fig. 2.61 (Version 1) as a ba- 
sis, Version 5 (Fig. 2.62) is produced using the process outlined above with A = 0.92. 
Taking additional measures from the available array of current best SOLAS practice, 
it was possible to further increase the attained A-Index to 0.985, without sacrificing 
any of the vessel’s functionality. Time domain simulations with PROTEUS3 have 
shown that such a vessel would survive all probable damages up to 3-compartment 
damage for all sea states up to 4 m Hs (the international voyages limit for Stockholm 
Agreement). 


Flooding Vulnerability Assessment 
Following from Sect. 3.1, the risk profile of Version 1 of the example cruise ship 


is illustrated in Fig. 2.63 for all the statistically possible damage scenarios deriving 


Table 2.4 Principal particulars of example cruise vessel 


Length 270m 
Breadth 35.5m 
Draught 8.3m 
Displacement 56,500 tonnes 
Metacentric Height 2.35m 
Number of passengers 2,300 
Attained Index of Subdivision, A 0.8 


Required Index of Subdivision, R 0.8 
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Fig. 2.63 Distribution of relative contribution to risk per damage case, ver | 


from the probabilistic rules for damage stability (Hs, loading condition, collision 
and grounding — the latter in addition to the current set of scenarios, which relate 
only to collision damage statistics). 

As indicated in Sect. 3.1, these scenarios could be supplemented by using 
relevant experiential knowledge judiciously and through HAZID/brainstorming ses- 
sions with designer/yard/owner participating, aiming to identify any design vul- 
nerability. Numerical simulations can then be used in calm water and in waves 
(as required) to establish the exact flooding mechanism and identify cost-effective 
changes for the local watertight arrangement using, for example, the PROTEUS3 
software suite. The results are analysed in terms of occurrence of potentially dan- 
gerous behaviour or attitudes by addressing the following three modes of flooding 
explicitly, on a case by case basis and using a much more complex (in terms of 


Proteus 3.1 


Fig. 2.64 Typical model used for flooding survivability analysis 
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number of compartments and number of openings) and more complete model (up to 
5 decks are being modelled — see Fig. 2.64): 


(a) Initial (transient) Flooding 
(b) Cross-Flooding 
(c) Progressive Flooding 


Focus during intermediate stages of flooding targets risk associated with the fol- 
lowing hazards: 

Transient and Intermediate Flooding. Having to deal with such a complex ge- 
ometry, explicit dynamic flooding simulation of a damaged ship in waves is a must. 
Static analysis simply will not do. Moreover, in some cases where cross-flooding 
through intricate connection arrangements becomes a problem in terms of long 
cross-flooding times, results from simplified time-domain simulation codes need 
to be supported using CFD as the only viable option for a proper treatment of such 
a problem. The fact that industry appears to be pre-ordained to use static analysis 
when addressing damage survivability could at best affect adversely the design pro- 
cess and at worst severely undermine safety. Figures 2.65 and 2.66 demonstrate two 
such cases. In Fig. 2.65, the s-factor results in zero, because the angle of inclination 
exceeds the statutory range, which does not reflect what actually happens. 

Conversely, Fig. 2.66 shows a damage case where the s-factor results in zero 
based on the SOLAS 2009 formulation whilst numerical simulation results indicate 
progressive flooding, likely to result in capsize/sinking. 

Multi-free Surface Effect. This mechanism of capsize is relevant to ships with 
complex watertight subdivision such as cruise ships. As the hull is breached, water 
rushes through various compartments at different levels (Fig. 2.67), substantially 
reducing stability even when the floodwater amount is relatively small. As a result 
the ship can heel to large angles, even for small damage openings, letting water into 
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Fig. 2.65 Numerical simulation of transient flooding behaviour (calculated s = 0) 
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Fig. 2.66 Numerical simulation of transient flooding behaviour (calculated s = 1) 


Fig. 2.67 Multi-free surface effect during intermediate stages of flooding 


the upper decks that spreads rapidly through these spaces and may lead to rapid 
capsize at any stage of the flooding. 

Bulkhead Deck Submergence and Progressive Flooding (Ducting, Piping, Doors, 
Windows, Shafts, etc). Scenarios of this nature demonstrate the need for explicit 
knowledge on how the flooding process evolves, as in many cases it proves to be 
rather straightforward to impede the evolution of flooding with easy and very cost- 
effective measures. Figures 2.68 and 2.69 show the post-processing that modern 
tools afford in this quest. 


Time to Capsize 
The results of the foregoing investigation is analysed in terms of the distribution for 


the time it takes the vessel to capsize/sink, one of the key parameters in flooding 
risk estimation. As outlined in the RBD Overview, accounting only for the damage 
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Fig. 2.68 Time-domain simulation of the flooding process (windows and SWT doors) 


Fig. 2.69 Time-domain simulation of the flooding process (various openings) 


case scenarios implicit in the new harmonised rules for damage stability (normally 
over 1,000) and considering the 3 loading conditions, also implicit in the rules, and 
some 10 sea states per damage case, one would have to deal with tens of thousands 
of scenarios. Therefore, as indicated earlier, two lines of action are being followed: 
the first entails automation of the process using Monte Carlo simulation; the second 
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Fig. 2.70 Cumulative probability distribution for time to capsize within a given time for two ship 
layouts shown in Figs. 2.22 and 2.23 


relates to the development of a simpler (inference) model for estimating the time to 
capsize for any given collision damage scenario. 

For the example cruise vessel, results using the simpler model are displayed in 
Fig. 2.70, next. 

A close examination of Fig. 2.70 reveals that a 15% increase in Index-A from 
Version | to 5 of the example cruise ship, results in a 60% reduction in the prob- 
ability to capsize within 3h. Knowledge of the probability of survival beyond [3] 
hours in all relevant flooding scenarios would provide the basis for ascertaining safe 
return to port capability as shall be explained next. 


Casualty Threshold 


Putting forward an argument for having acomprehensive risk model and framework to 
evaluate the total risk of a ship, it is important to appreciate that the aggregate number 
deriving from such a process, which will represent the safety measure of a ship (safety 
level), could not be used as the sole criterion for design or approval purposes. Risk 
components contributing to the total risk will still have to satisfy hazard-specific risk 
acceptance criteria to avoid undermining safety through what is known as “compen- 
sation effect” (e.g. having some of the high risk flooding scenarios, say one compart- 
ment damage, being compensated by the contribution to aggregate safety level of all 
the other damage cases, which might satisfy the rules but would still leave the vessel 
vulnerable and this in itself would not be acceptable). In such cases, it needs to be 
appreciated that severity and frequency are normally not interchangeable in the high 
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stakes regime, meaning that individuals and society would (given an explicit choice) 
not act in accordance with normative decision theory. 

In this respect, safeguards ought to be put in place for all component parts con- 
tributing to the calculation of this single number, right down to loss scenario level 
i.e., achieving a high Index of Subdivision by focusing on average safety standards 
must not be allowed in the knowledge that highly probable damage scenarios are 
non-survivable. 

Therefore, focusing on the casualty threshold with respect to collision damage 
(damage extent) two complementary lines of action emerge. The first is to min- 
imise total risk as an aggregate statistic (here equivalent to maximising Index-A) 
in the knowledge that all components contributing to risk are likely to be reduced. 
In addition, high-risk damage scenarios, normally associated with one- and two- 
component damage ought to be catered for. In fact, the argument could be taken 
one step further by stating that for design purposes a (large) passenger ship ought 
to survive up to two-compartment damage in all loading conditions and sea states. 
In fact, this was the intention in designing passenger ships under the deterministic 
SOLAS regime (e.g. SOLAS 1990), despite the fact that in reality this intention is 
not completely fulfilled. Such a safety-related performance criterion will provide a 
clear-cut, unambiguous threshold that could serve to reduce uncertainty drastically 
at a time when a decision to abandon ship in a flooding-related casualty is needed. 
Additional information available when the said casualty occurs will help to further 
aid decision making. 

Indeed, an introspective look into the results of the example cruise ship, shown 
below in Fig. 2.71, reveals that this requirement is not difficult to achieve. Even 
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with Index-A of 0.8 the risk contribution of 2-compartment damages is just over 
2%, reducing to zero for Version 5 (A = 0.92). In the latter, even for 3-compartment 
damages the risk contribution falls below 2%. 

At this stage of development, fire-related casualty threshold is much more clear 
cut, considering that the effect of fire is normally space specific and does not influ- 
ence the whole ship in the way a flooding scenario might do. 


Safe Return to Port 


Having explored all issues pertinent to safe return to port, an attempt will be made 
here to synthesise these in accordance with the IMO framework, Fig. 2.15. Deriving 
from this, it will be helpful to classify flooding-related casualties as proposed in 
Table 2.5 below (covering the whole risk space of interest): 

The functional requirements corresponding to the same categories can also be 
classified as shown in Table 2.6. 

As a next step, quantifiable performance criteria would need to be developed that 
reflect the specific functional requirements but from the point of view of decision 
making in emergency situations, following a casualty, relevant criteria could readily 
be adopted as shown in Table 2.72. 

Adopting the framework presented in Table 2.72 as a basis would reduce a com- 
plex and serious problem to manageable proportions, and this could be supple- 
mented by additional information, specific to the casualty in question (actual ex- 
tent of damage, sea state and so on). The proposed categorisation could be further 
fine-tuned, particularly concerning the more extensive damages (Categories III-4 


Table 2.5 Flooding-related casualty classification 


Casualty severity Safety objectives 
Category I Vessel remains upright and afloat and is able to return to port under 
(1-compartment damage) own power (RTP) 
Category II Vessel remains upright and afloat, but unable to return to port under 
(2-compartment damage) own power/wait for assistance (WFA) 
Category III-3 Vessel likely to capsize/sink. Abandonment of the ship may be 
(3 or more-compartment necessary (AS) 
damage) 


Table 2.6 Flooding-related functional requirements classification 


Systems/functions availability Functional requirements 


Category I (Full) All necessary habitability and transport functions available for 
(5) days 

Category II (Partial) All necessary habitability functions available for (5) days 

Category II-3 (Basic) Basic habitability functions and emergency systems availability 


for (3) hours. 
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Fig. 2.72 Decision making in flooding-related casualties 
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Casualty Severity 


Design Criteria (Safety- and 
Functionality-related) 


Category I 
(1-compartment damage) 


Category II 


(2-compartment damage) 


Category II-3 
(23-compartment damage) 


P[tc 3 hours] = 100% 

Heel, trim limits as per SOLAS 
Systems Availability 

> Full 

P[tc 3 hours] = 100% 

Heel, trim limits as per SOLAS 
Systems Availability 

> Full 

Systems Availability 
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P[tc 3 hours] = 100% 

Heel, trim limits as per SOLAS 
Systems Availability 

> Full 

Systems Availability 

> Partial 

P[tc 3 hours] < 100% 

Heel, trim limits as per SOLAS 
Systems Availability 

> Basic 


Outcome 


and III-5), based on results of purposely undertaken studies and on open discussion 


and debate at IMO. 


Finally, as indicated in the foregoing, functions/systems availability at the “Ba- 
sic” level is a requisite for all scenarios but what constitutes “Basic” as well as 


what is considered necessary at “Partial” or “Full” levels is primarily a decision of 
economics in need of full consideration in the design stage. 


Similar developments with regard to fire-related casualties are already embedded 


in SOLAS. 


2.2.2.2 Fire Safety Analysis 


Similar to flooding survivability analysis, fire safety normally entails the following: 


e Statutory fire protection (SOLAS Chapter I-2) 
e Evaluation of vulnerability to fire (fire risk screening) 


— Each space onboard assumed to be a potential space of fire origin 
— Evaluation of the frequency of fire ignition 
— Evaluation of the probability of fire escalation beyond the space of fire origin 
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— Evaluation of the risk to the ships’ occupants in night and day case scenarios 
(FSS code) 
— Aggregation of the above for the whole ship (total values) 


e Systems availability for each fire scenario 
— Geometrical and topological evaluation of main ship systems 
e Evacuability assessment 


— Assembly and evacuation performance 
— Assessment of each untenable condition against total evacuation time 


e Evaluation of casualty threshold/return to port capability 
— Probabilistic approach; link to system availability post-casualty 


Generic results, pertinent to large passenger ships, are shown in Figs. 2.73, 2.73 
and 2.74. 


2.2.2.3 Safety Level 


With all the elements in place, there is still one step to make, namely to estimate 
the safety level using the framework and risk model presented in “RBD Overview” 
and apply it to the example cruise vessel by considering flooding and fire hazards as 
outlined next. 
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Fig. 2.73 Fire incidence — correlation between frequency of fire and fire zone size 
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Fig. 2.74 Fire escalation — correlation between frequency of fire escalation and fire zone size 
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Fig. 2.75 Fire risk — correlation between risk and fire zone size 


Flooding (Collision Only Events) 


Using the formulation outlined earlier, the probability for N fatalities occurring 
due to collisionN flooding events can be expressed as shown in Eq. (2.4), where 
prn(N|flooding) = pry (N|hz,), with the probability mass function presented 
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Fig. 2.76 Probability distribution for N fatalities o due to flooding for the example cruise vessel 


here in Fig. 2.76. To estimate the contribution to risk from flooding loss 
scenarios, Eqs. (2.1), (2.2), and (2.3) are also used together with the statistical 
value for the frequency of occurrence of collisionN flooding events per cruise ship 
year (2.58E-03). 

Figure 2.76 displays a numerical result (bimodal distribution) that makes sense 
readily on account of statistics. It emphasises the fact that collision flooding 
events result in relatively few fatalities or a very large number of fatalities rather 
than a mid-range value. 


Fire 


A heuristic argument is used here to estimate the fire risk contribution that accounts 
for available numerical results for a cabin case fire scenario using the example cruise 
vessel, namely assuming (seriously on the conservative side) that the sample distri- 
bution for V number of fatalities is representative of such distribution for the whole 
ship. Hence, similar to flooding, to assess the contribution to risk from fire loss sce- 
narios, it is necessary to model both the frequency of fire occurrence per ship year, 
fThz (hz = fire), as well as the probability distribution, py (N | fire), for N number 
of fatalities onboard the ship due to fire events. 

The first of these, annual frequency of fire events, is given in from historical 
data as 1.2e-2 occurrences per cruise ship year. To derive the second term, use is 
made of first-principles tools available at SSRC as described in Sect. 3.1. Using 
these tools, prediction of the probability distribution for the number of fatalities 
due to fire at the cabin in question is done through Monte Carlo simulation for 
a range of parameters relevant to the specific location considered. An example of 
prediction of the py, (N | fire cabin) based on some 800 runs for one location 
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Fig. 2.77 Probability distribution for occurrence of N fatalities due to fire in accommodation 
spaces of the example cruise vessel 


in accommodation spaces (day and night scenarios) is shown in Fig. 2.77. This is 
a noteworthy result, displaying the known fact that the number of fatalities in fire 
events is more frequently a small fraction of the passengers/crew onboard. 

To allow for risk integration, it is further assumed, as indicated above that 
this sample distribution for N is representative of such distribution for the whole 
ship weighted according to fire statistics onboard passenger ships, as shown in 
Table 2.7 below. 


Risk Integration (Equations Refer to Lecture on RBD Overview) 
To illustrate the relative contributions of fire and flooding loss scenarios to the risk 


integral Eq. (2.1), the probability mass functions given by Eqs. (2.4) and (2.10) for 
flooding and fire, respectively, can be compared, as shown in Fig. 2.78. 


Table 2.7 Probability distribution for occurrence of fire onboard passenger ships (1990-2003) — 
Germanisher Lloyd, FP49/3/1 
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Fig. 2.78 Probability distribution for N number of fatalities occurring due to fire and flooding for 
the example cruise ship (version 1) 


Alternatively, such comparison can be made using either of the models in 


Egs. (2.1) and (2.2), being used separately or combined. Both results are shown 
in Fig. 2.79. Also drawn on Fig. 2.79 is the ALARP region using the societal risk 
evaluation criteria, recommended for cruise ships, (Skjong 2006). 


Deriving from Fig. 2.79, the contribution to risk from flooding and fire as well as 


the risk as a summary statistic are now at hand. More specifically, 


Risk¢oilision A flooding = 1.14 fatalities per ship year 
Risk fire = 0.11 fatalities per ship year 
Total Risk = 1.25 fatalities per ship year 


On the basis of the foregoing the following remarks can be made: 


The “holly grail” is not really the absolute value of the risk numeral itself (for the 
uncertainty in its evaluation is too large for comfort) but the fact that this sum- 
mary statistic derives from a comprehensive model that links all contributions to 
risk in a way that a bottom up approach will never be able to achieve in as com- 
plex a system as a large passenger ship. In other words, a truly holistic approach 
has to be linked to total risk estimation and as such address safety top down, 
leading to identification of design vulnerability and cost-effective risk reduction 
measures. 

Having said this, as much as an aggregate risk numeral can convey a lot of in- 
formation, it could equally “hide” a lot of information; hence the need to apply 
safeguards at individual risk contributors, right down to individual scenario level 
of each hazard in question with performance criteria in place to ensure “fitness 
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Fig. 2.79 The annual frequency of occurrence of N or more fatalities due to loss scenarios of fire 
and flooding for the example cruise ship (Version 1) 


for purpose”. This however, must be seen as the second step in targeting cost- 
effective safety. 

e Ascan be seen in Figs. 2.76 and 2.77, the distinctive feature of the loss scenario 
involving hull breach and flooding is the high possibility of catastrophic scenar- 
ios involving very large number of fatalities. Although not entirely unexpected, 
this result demonstrates the importance that needs to be placed on ship stability 
deficiencies; the flooding risk contribution is an order of magnitude higher than 
that due to fire despite the fact that, according to statistical data, fire accidents are 
nearly 5 times more frequent than collision accidents. It is also to be noted that 
contributions to total risk from grounding-related flooding loss scenarios have 
not been accounted for; for large passenger ships, this is a large contribution 
according to (Skjong 2006). 

e The derived F-N curve shows that with the example cruise ship used in this study, 
the likelihood for a catastrophic accident is unacceptably high; hence measures 
ought to be taken to reduce it irrespective of cost. 


To demonstrate how this might be done, Version 5 of the example cruise ship 
(having an A-Index of 0.92) has been used as a first iteration. The outcome is rather 
interesting and is presented in Figs. 2.80 and 2.80, demonstrating emphatically the 
importance of targeting high Index-A values in cruise ship designs. Notably for a 
15% increase in Index-A, total risk is reduced by 60%! 
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the example cruise ship (versions | and 5) 
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Chapter 3 
Regulatory Framework 


Rolf Skjong 


Abstract The present chapter is about ongoing activities and methodologies in use 
to gradually change the regulatory framework by systematic use of Formal Safety 
Assessment (FSA). This development is in the direction of a risk and goal based reg- 
ulatory system. Risk based entails that the most important rules and regulations need 
to be justified on the basis of FSA, and goal based implies that the goals and func- 
tional requirements are formulated as long standing requirements without reference 
to specific technology or ways on how the goals should be achieved. The technology 
dependent rules and regulations are seen as standardized ways of achieving the goals 
for standard technical solutions. For innovative solutions, where detailed technology 
dependent rules and regulations do not exist, Risk Based Design (RBD) offers an 
alternative. RBD implies that the methods used to justify the rules and regulations 
are used directly for the development of each innovative concept. The chapter ex- 
plains the related basic methodologies and frameworks and includes results of case 
studies from the gained experience with the development so far, in particular the 
experience from the use of FSA at the decision making process by the International 
Maritime Organization (IMO), including some experience from ongoing activities 
in the frame of developments of Goal Based standards (GBS) 


3.1 Introduction 


Many regulations in various industrial sectors internationally and within national 
boundaries are today based on some form of risk based analysis and justification. 
The term ‘risk based’ is not necessarily used. For example the nuclear safety regu- 
lations in the US are referred to as ‘risk informed’. The distinction made by using 
the term ‘risk informed’ rather than ‘risk based’, is that the Nuclear Regulatory 
Commission (NRC) may make other considerations than those contained in a risk 
analysis when making decisions on regulatory actions. At the International Mar- 
itime Organisation (IMO), the UN body regulating maritime safety, the situation is 
similar and reflected in the fact that officially the traditional term ‘risk acceptance 
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criteria’ is replaced by the term ‘risk evaluation criteria’. At IMO this reflects the 
fact that Formal Safety Assessment (FSA), which is the term used for the risk as- 
sessment used to justify new or amended regulations, is not intended to be used to 
automate the decision process, but to inform the decision makers about risks, risk 
reduction and costs of taking a specific action in the form of implementing a specific 
Risk Control Option (RCO) that has been recommended by an FSA. 

Today, the term ‘Risk Based Regulation’ implies the tendency to be used together 
with the term ‘Goal Based Standard’ (GBS), which is a more recent initiative also 
at IMO (and a popular term elsewhere, where a regulatory reform is debated). It is 
probably fair to say that the concept is not clearly defined at IMO and that IMO del- 
egates may have different interpretations and understanding of what GBS is about. 
However, it is evident that GBS is intended to restructure the regulations based on 
a top down process, starting with a high level description of the (safety) objectives 
and functional requirements. The prescriptive requirements (in Codes, Rules and 
Regulations) are then in need of being verified to meet the goals and functional 
requirements and the ship herself is in the need of being verified to comply with 
the Codes, Rules and Regulations. The Regulatory system is therefore sometimes 
described as indirect, because the Goals and Functional Requirements are defining 
Rules for Rules that the Rules for Ships need to fulfil (sometimes referred to as an 
indirect goal based approach). 

It should be noted in this context that FSA is also Rules for Rules. FSA is ac- 
tually a rather detailed description of how a new regulation should be structured 
and justified, considering risks, risk reduction by implementing the regulation and 
costs associated with the implementation. This fits perfectly with the GBS ideas, as 
the FSA is also an analysis that may be verified, and there is already a verification 
process in place (IMO 2007). 

The topics of this chapter are therefore: Formal Safety Assessment, Goal Based 
Standard, Risk Evaluation Criteria in FSA and Risk Based Design, together with a 
section on practical experience with FSA. 


3.2 Formal Safety Assessment 


3.2.1 Historical Background 


The application of risk analysis techniques is generally well established in most 
industries, both as a means for the owner/operator to manage their own risks and for 
the regulator to prioritise work on the development of Rules and Regulations. 

Most risk analysis techniques have their origin in the nuclear industry, for which 
risk analysis became an important tool in the 1960s, and has now developed into a 
Probabilistic Safety Assessment (PSA), (Freeman and Moir 1993). The focus here is 
on the probability of releases from nuclear containments. The PSA will be regularly 
updated, e.g. after upgrades, inspections, maintenance. 

In the hazardous chemical industry, risk analysis techniques were adopted in the 
°70s. Within the EU and the European extended economic area, risk analysis was 


3 Regulatory Framework 99 


required by the EU Seveso I directive in 1982, which has later been replaced by the 
Seveso IT directive. 

In the offshore industry, the use of risk analysis has been required since 1986 
in Norway and in the UK since 1992 as a consequence of the Piper Alpha disaster. 
The risk analysis is carried out on behalf of the owner of the plant, and has to be 
well documented. The document is called a Safety Case in the UK, which will be 
approved by the UK Health and Safety Executive. In Norway the authorities do not 
approve such documentation or any safety targets, but they are allow insight into 
the safety related decision making process of the individual enterprise, and act on 
situations which are not acceptable. 

On a generic policy level, most OECD countries require risk analysis as the basis 
for regulation. For example, already according to the US President Executive Order 
no. 12866 on ‘Regulatory Planning and Review’ e.g. the US Coast Guard had to 
base their Rules and Regulation on Risk Analysis and Cost Benefit evaluation. 

Finally, it should be noted that both ISO and CEN (Comité Européen de Nor- 
malisation/European Committee for Standardization) have their structural standards 
based on risk assessment, and the use of Structural Reliability Analysis. 

In the shipping industry, most of the statutory regulations in the past have been 
developed as a reaction to major accidents and disasters. In 1992, the UK House of 
Lords Select Committee on Science and Technology recommended a Safety Case 
Regime for shipping, similar to that already adopted in the oil and gas industries. It 
also recommended a move towards performance standards in place of prescriptive 
rules (indicating that GBS was predicted — see below) and a concentration on the 
management of safety. 

In 1993, during the 62nd session of the IMO Maritime Safety Committee (MSC), 
the UK Maritime and Coastguard Agency (MCA) (MSA at that time) proposed a 
standard five step risk based approach, which was called Formal Safety Assessment 
(FSA). In 1996 the IMO established a working group on FSA, and by 1997 a Cir- 
cular on Interim Guidelines on the Application of FSA to the IMO Rule-making 
Process (IMO 1997) had been developed, which was adopted by the MSC and the 
Maritime Environmental Protection Committee (MEPC) in the same year. Since 
then, a number of FSA studies have been carried out and presented to the IMO. 
At MSC80, the FSA Guidelines were updated the second time. The last version is 
available (IMO 2007) now including such elements as risk evaluation criteria and 
an agreed process for reviewing FSAs. 


3.2.2 Purpose of FSA 


Formal Safety Assessment (FSA) is a structured and systematic methodology, aimed 
at enhancing maritime safety, including protection of life, health, the marine envi- 
ronment and property, by using risk analysis and cost benefit assessment. 

FSA can be used as a tool to help in the evaluation of new regulations for mar- 
itime safety and protection of the marine environment or in making a comparison 
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between existing and possibly improved regulations, with a view to achieving a 
balance between the various technical and operational issues, including the hu- 
man element, and between maritime safety or protection of the marine environment 
and costs. 

FSA is consistent with the current IMO decision-making process and provides a 
basis for making decisions in accordance with resolutions A.5OO(XID “Objectives 
of the Organization in the 1980s’, A.777(18) ‘Work methods and organization of 
work in committees and their subsidiary bodies’ and A.900(21) “Objectives of the 
Organization in the 2000s’. 

The decision makers at IMO, through FSA, are able to appreciate the effect of 
proposed regulatory changes in terms of benefits (e.g. expected reduction of lives 
lost or of reduced pollution) and related costs incurred for the industry as a whole 
and for individual parties affected by the decision. 

FSA should facilitate the development of regulatory changes equitable to the 
various parties thus aiding the achievement of consensus. 


3.2.3 Application-General 


In the FSA Guidelines it is stated that the FSA methodology can be applied by: 


e aMember Government or an organization in consultative status with IMO, when 
proposing amendments to maritime safety, pollution prevention and response- 
related IMO instruments in order to analyse the implications of such proposals; or 

e a Committee, or an instructed subsidiary body, to provide a balanced view of a 
framework of regulations, so as to identify priorities and areas of concern and to 
analyse the benefits and implications of proposed changes. 


In practice, option 2 has proven unrealistic. It takes a project to run an FSA. This 
implies that option | has always been followed, with some intermediate reports to 
IMO. Usually a new project informs IMO by submitting the HazId Report (Step 1 
of FSA). The full FSA Report may follow one or two committee meeting later. 

It is not intended that FSA should be applied in all circumstances, but its ap- 
plication would be particularly relevant to proposals which may have far-reaching 
implications in terms of either costs (to society or the maritime industry), or the 
legislative and administrative burdens which may result. However, if a Goal Based 
Standard (GBS) is implemented, FSA may be made mandatory under agreed con- 
ditions at a later stage. This has been proposed, but so far not discussed in detail 
at IMO. 

FSA may also be useful in those situations where there is a need for risk reduc- 
tion but the required decisions regarding what to do are unclear, regardless of the 
scope of the project. In these circumstances, FSA will enable the benefits of pro- 
posed changes to be properly established, so as to give IMO Member Governments 
a clearer perception of the scope of the proposals and an improved basis on which 
they take decisions. 
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3.3 What is FSA? 


FSA is a risk based approach consisting of five inter-related steps: 


Identification of hazards 

Assessment of the risks arising from the hazards identified 

Identification of options to control the risks 

Cost/benefit assessment of the risk control options 

Recommendations for decision making, based upon the information derived in 
the previous steps (Fig. 3.1). 
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The safety of an aspect under consideration is assessed by evaluating the risk ac- 
companied with this aspect, e.g. a specific operation. The decision upon the accept- 
ability of that risk is done by employing risk acceptance criteria, as discussed below. 

Compared to the previous safety assessment approach there are several differ- 
ences to be observed. In the past, most decisions on regulatory changes at IMO 
were initiated as a reaction to an accident. The decision on safety requirements re- 
sults from activities after the problem occurred, focusing on the question: What went 
wrong? The FSA approach is pro-active, by trying to find out before an accident oc- 
curs: What might go wrong? 

In the previous safety assessment approach the risk was normally not explicitly 
evaluated. The FSA approach tries to find out the likelihood of scenarios, which may 
possibly develop from hazards, and the magnitude of their consequences in order to 
calculate the risk. 

As the previous safety assessment process was mainly reactive to an accident 
rather than pro-active, decisions on how to improve matters were often carried out 
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on an ad-hoc basis, influenced by public and political pressure. Quick solutions were 
therefore preferred and an assessment of the costs and the benefits of such solutions 
were normally not performed. A case illustrating the point is the development of 
the International Ship and Port Security (ISPS) Code, which has developed fast and 
with little analysis, following the *9.//’ attack. The FSA approach, on the other 
hand, systematically analyses the different options which are available to control 
the risk, and also assesses both the costs and the benefits of those options should 
they be implemented. The final decision on safety requirements can therefore be 
made on the basis of a thoroughly performed analysis. 

The previous reactive approach has lead to a continuous amendment of al- 
ready complex and sometimes inconsistent regulations. These regulations are often 
characterised as being prescriptive, leaving only limited room for other (technically 
equivalent) solutions to a safety problem than those “prescribed”. Especially in pe- 
riods of rapid technology developments the pace of regulatory developments is too 
slow to cope with industrial needs and the principle of technical equivalence an ob- 
stacle. Specific safety objectives and functional requirements (as developed follow- 
ing the GBS approach) would be more useful, requiring safety goals/performances 
to be met, encompassing both technical and operational aspects. This type of regu- 
lation is often called “performance or goal based regulation” (see below). 


3.4 Development of Risk Assessment and FSA 


The use of risk assessment also at IMO started prior to the development of the FSA 
guidelines. Actually the development of probabilistic design tools started already in 
the sixties, with the development of probabilistic damage stability. 

About 30 years later, another step in the development of new probabilistic 
damage stability regulations started (the EU Commission funded research project 
HARDER, 2000-2003), which delivered an important input to the amendments 
to SOLAS approved by the International Maritime Organisation’s Maritime Safety 
Committee in December 2004 and entering into force January 1, 2009. 

However, this work can be traced back to the late 1960s, when Prof. Wendel 
of Hannover/Hamburg Universities outlined his ideas on the ‘Subdivision of Ships’ 
(Wendel 1968). Subsequent work by a specialist IMO group used his basic ideas 
to develop a new set of subdivision regulations. The outcome of this work was the 
‘Equivalent Passenger Ship Regulations’, based on probabilistic analysis, and al- 
lowing freedom for the designer as long as the conditional probability of surviving 
a collision is acceptable. The marine industry has therefore had access to probabilis- 
tic design tools for very long. It is the more widespread use of risk based approaches 
for design and for justification of rules and regulations that is the more recent 
development. 
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3.4.1 Risk Assessment ‘Solo Watch-keeping During 
Period of Darkness’ 


At the Maritime Safety Committee (MSC) meeting in May 1996 (MSC66), the first 
FSA working group met. DNV! had just carried out a risk assessment for Denmark 
related to the ‘Solo Watch-keeping During Periods of Darkness’ (Denmark 1996). 
For a period of about ten years ships with advanced bridge design had been ex- 
empted from the requirement of having a watch-keeper during periods of darkness 
as a trial. The DNV study indicated that a ship with such modern, high tech bridge 
systems design had a reduced risk of navigational accidents of about 50% as com- 
pared with a traditional bridge system. Denmark, Sweden, Norway, Germany, The 
Netherlands and UK had continued to operate these ships with solo watch-keeping, 
after an agreement had been reached to terminate the trials at MSC65 in May 1995, 
but without an agreement on the date of ending the trials. At the MSC66 meeting, 
an intense debate started between on the one side a group of nations supporting risk 
analysis and on the other side a group of nations favouring a political approach, 
without analysis of data. At MSC66 there was no final conclusion and a compro- 
mise was agreed between the countries active in the trials and those wishing them 
to end the trials. The compromise was to end the trials December 31, 1997, and ask 
the nations involved in the trials to report at MSC69, in 1998.2 

At MSC69, the debate proved in many ways a repetition of MSC66. All reports 
from those involved in the trials concluded that the modern bridge that allowed for 
Solo Watch-keeping during period of darkness was as safe as or (much) safer than 
the traditional bridge. Also this time the arguments were substantiated with risk 
analyses. This time Denmark (1998) submitted a report where the Danish Technical 
University had carried out an FSA using Bayesian Network Modelling for Naviga- 
tional Safety. The conclusions were similar to those submitted to MSC66 (Denmark 
1996). Sweden (1998) submitted a more traditional analysis, with clear conclusion 
that the modern bridge without lookout during periods of darkness was as safe as or 
safer than the traditional bridge with lookout. Germany (1998) reported on simula- 
tor testing and risk assessment also with clear and similar conclusions. This did not 
prevent that the trials were ended. In the aftermath, it is probably fair to say that it 
is too late to inform IMO about a conducted risk assessment or any other analysis 
at a time when political decisions have already been made at national level, as IMO 
delegates are bound by political decisions in their home counties. 

From FSA perspective, MSC69 was the first time a risk assessment based on 
Bayesian Networks had been presented at IMO. This method later gained popularity 
for modelling navigational safety in later studies (see below). The legal implication 
is also interesting: A flag state is allowed to accept equivalent solutions, following 
agreed reporting procedures. 


' The author’s role in this study was as internal verifier for DNV on the risk analysis part. 
? A summary may be found in: The Journal of Commerce, 11/6-1996. 
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3.4.2 FSA — High Speed Craft 


The first application of the FSA Guidelines, at that time referred to as the “Interim 
Guidelines’ IMO 1997), and referring to the FSAs as “Trial Applications’, were the 
FSA on High Speed Crafts (HSC) carried out by UK. The first reports were submit- 
ted to MSC68 by UK (1997). These reports had been submitted without the con- 
sent of the members of the International Steering Board,* and the reports were also 
heavily criticized. For example the risk figures were unrealistically high, without 
a good explanation. Another controversy was that the risk models were not used 
for estimating the risk reduction. A rather unrelated model referred to as Regula- 
tory Impact Diagram (RID) was used for this purpose. The references to RIDs were 
later removed from the IMO FSA Guidelines. Despite the heavy criticism, the re- 
ports were forwarded to the IMO DE committee, because DE was working on the 
revision of the HSC Code. However, UK updated the reports and submitted new ver- 
sions to DE. Due to time constraints DE referred the issues back to MSC69, asking 
for a Review at MSC69 by FSA experts. As this FSA was never properly completed 
and reviewed, it ended up not being used for other decision-making than amending 
the FSA Guidelines. 


3.4.3 FSA — Helicopter Landing Area on Cruise Ships 
as a Safety Measure 


The idea of recommending a helicopter landing area (HLA) as a safety measure on 
passenger ships came from the Panel of Experts (PoE) working with improving pas- 
senger ship safety following the Estonia Accident (Estonia 1997). During the rescue 
operation, a HLA was cleared at the RoPax vessel coming to the scene of the ac- 
cident, and during the extensive helicopter operations an air traffic coordinator was 
flown to the nearby ship SILJA EUROPA. The pilot on one of the two helicopters 
landing on the ship stated that ‘landing on the ferries was the most difficult part of 
the whole rescue operation’ (Estonia 1997, p. 107). When the proposals from the 
PoE came to IMO, the cruise industry was not represented, because the proposed 
safety measures were intended for use only on RoPax ships. It therefore came as 
a surprise to the industry when some of the suggested risk control options (RCOs) 
were made applicable also to non-Ro-Ro passenger ships. 

The FSA/HLA was a response from the industry to extending the recommenda- 
tion to all passenger ships, without considering the different modes of operation. 
It was carried out by DNV (Skjong et al. 1997) and submitted to the Design and 
Equipment Sub-Committee DE41 (Norway and the International Council of Cruise 
Lines (ICCL) 1997) and also to the Sub-Committee on Communication and Search 
and Rescue (COMSAR). Paragraph 86 of Norway and ICCL, (1997) is summing 
up how the FSA was carried out, namely: ‘The FSA was carried out with mod- 


3 The author was member of the International Steering Board. 
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elling assumptions valid for non Ro-Ro passenger ships. The recommendations are 
primarily based on considerations of costs and benefits of installing an HLA. The 
implied costs of averting a statistical fatality (ICAF) have been estimated to be a 
factor of 20-100 higher (less cost effective) than for safety measures commonly rec- 
ommended for implementation in OECD countries. Requiring helicopter landing 
areas on non-Ro-Ro passenger ships is therefore not recommended. This conclusion 
has been further substantiated by a comprehensive review of historical data and by 
a statistical model. The two models are quite different, and it is reassuring that the 
two independent analyses lead to the same conclusion’ . 

The study by Norway and ICCL, and the later supporting submission by Italy 
were all reviewed by the intersessional working group (WG) on FSA, working be- 
tween MSC69 and MSC70. The results are reported in UK (1998a). The review 
concluded that the studies very generally making assumptions that would favour 
HLA (818), indicating that the recommendation would be robust. In addition, the 
group observed that HLA could encourage the use of HLA for other purposes and 
that this other use could increase the risk (§29.3). As this was the first FSA that could 
result in a conclusion the WG FSA at MSC70 also reviewed the report of the Cor- 
respondence Group (CG) and reached a final recommendation. IMO (1998) 814.14 
reads ‘The Committee noted that the cost-effectiveness of a helicopter landing area, 
in terms of the cost of implementation divided by the expected number of additional 
lives saved (i.e. ICAF,4 the implied cost of averting a fatality) is US$37 million and 
that, acknowledging the uncertainties in the evaluation of both risk benefit and cost, 
the group agreed that the ICAF may range from about US$12 to 73,000 million, 
Based on the recommendation of the WG, MSC concluded (IMO 1998) §14.15 In 
the light of the above considerations, the Committee noted the group’s conclusion 
that the requirement for helicopter landing areas on non Ro-Ro passenger ships 
cannot be justified in terms of the cost-effectiveness of the measure in reducing risk. 
In reaching this conclusion the group had in mind that previous assumptions in the 
evaluation of both risk benefit and implementation costs were generally favourable 
to the HLA solution. Additionally, even at the most optimistic end of the range, the 
ICAF value exceeds the suggested criteria value. 

For the first time, IMO had made a decision based on FSA, including assessment 
of costs and benefits. The credibility of FSA was established, §14.19 The majority of 
the delegations who spoke were, however, of the view that the thorough study carried 
out firstly by the Correspondence Group on Application of FSA and by the working 
group at this session vindicates the usefulness of the FSA concept in the rule-making 
process of the Organization. The remaining problem was to implement the conclu- 
sion, as a ‘regulation cannot be amended until it has been enforced’ according to 
the internal IMO internal procedures. This formal problem was resolved at MSC71. 
It should be observed that many ships, including non-Ro-Ro passenger ships, have 
in the meantime an HLA installed. This is not mandatory, and HLA is not installed 
as a safety measure. Actually, strict requirements apply to HLA operations, because 
of the risk it represents. 


4 In current terminology ICAF is replaced by GCAF, Gross Cost of Averting A Fatality. 
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3.4.4 FSA for Bulk Carriers 


3.4.4.1 Initial Studies 


The first FSA study on bulk carriers was carried out by DNV in 1997, and a paper 
was distributed to both the working group on Bulk Carrier Safety and the work- 
ing group on FSA during the MSC68 meeting (DNV 1997a). The study represented 
DNV’s justification for supporting the [ACS decision to strengthen the bulkhead be- 
tween No.1 and 2 cargo holds on existing bulk carriers. The justification was based 
on Net Costs of Averting a Fatality (NCAF) between $0.5 million and $1.5 million 
for the various types of bulk carriers analyzed. This decision is therefore consistent 
with later decisions at IMO and was based on criteria of cost effectiveness submit- 
ted by Norway (2000). The study was based on extensive analysis of casualty data 
and rather simple risk modeling. As the paper was widely referenced it is believed 
to have highly contributed to the understanding of FSA by the maritime industry. 


3.4.4.2 Bulk Carrier FSA Studies at IMO 


An FSA on bulk carrier safety was proposed by UK (1998b). The proposal was 
generally supported, although many delegates expressed concerns that the scope of 
the study was too broad. In the aftermath it may be noted that this concern was 
justified. Most of the risk control options adopted during MSC 76 in December 
2002 related to the fore-end watertight integrity — an issue put on the agenda prior 
to MSC 70 for urgent review. On this issue, [ACS submitted a hazard identification 
(HAZID) report to MSC 71 ([ACS 1999) and a full FSA to MSC 74 (IACS 2001). 
The study took about a year. The study uses standard risk assessment techniques 
involving fault and event trees and extensive analysis of accident data. In addition, 
to be able to quantify some of the risk reduction effects (e.g. strengthening of hatch 
covers), structural reliability methods (see Skjong et al. 1995) were developed based 
on detailed probabilistic modelling of strength, structural response and the marine 
environmental loads. 

Norway initiated the study on life saving appliances by preparing a document on 
risk acceptance criteria, as this was viewed as a preparatory step to an FSA. This 
document was submitted to MSC 72 (Norway 2000). Individual and Societal risk 
for bulk carriers and other ship types, given in Figs. 3.2 and 3.3, are taken from this 
document. 

The FSA study was reported to MSC 74 (Norway and ICFTU 2001). This study 
took less than a year, though it is very detailed in the risk modelling as compared 
to other FSA submissions. The level of detail reflected the need to quantify risk 
control measures that affected probabilities at a detailed level (use of different types 
of rafts, lifeboats and survival suits in different accidents scenarios). The study had 
to use human reliability data from other industries, as similar data did not exist for 
the maritime industry. The study was carried out independently of the UK Interna- 
tional study. 
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Fig. 3.3 Societal risk of bulk carrier and container vessel accidents 


Japan also delivered an FSA after the completion of a one year project (Japan 
2001), but decided to update the study to MSC 75 (Japan 2002a). The Japan study, 
much like the IACS study, is based on comprehensive assessment of accident statis- 
tics and rather limited risk modelling. Still, the study is sufficiently detailed for the 
decision making and relatively easy to follow. 

The international study was coordinated by UK based on terms of reference 
agreed during MSC 71 (IMO 1999). Up to MSC 76 only progress reports were 
received by IMO. An implication was that during MSC 75 in May 2002, the 
committee short-listed the recommendations from all studies including the UK 
recommendation, but without any reported FSA study from UK. The main study was 
subsequently reported to MSC76 (UK 2002a). UK also submitted a large number 
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of other papers on bulk carrier safety that were independent of the main FSA re- 
port, including a complete FSA carried out at Strathclyde (UK 2002b) on the [ACS 
unified requirement for hatch cover strength. 


3.4.4.3 Decision Making 


The final decision making based on the FSA studies on bulk carrier safety was 
scheduled for MSC 76 (December 2002). As previously stated, the risk control 
options had already been short-listed at MSC 75, and the working group tried to 
structure the order in which decisions were made. The reason is that decisions to 
implement one risk control option would affect the cost effectiveness of other risk 
control options as there would be “fewer to save’. Both Japan (2002a) and the Inter- 
national Association of Dry Cargo Shipowners INTERCARGO 2002) submitted 
papers discussing this final decision making process. For a risk analyst it may be 
difficult to understand the problem as such recalculations are rather trivial, and the 
whole idea of waiting to make all decisions relating to bulk carrier safety at the 
same time was that such dependencies between risk control options were unavoid- 
able, given that the many studies were carried out independently. 


3.4.4.4 The Risk Control Options and the Decisions 


The first and most important risk control option related to the side shell failures. 
These failures had been demonstrated by all studies to be a major contributor to 
bulk carrier casualties. The most comprehensive risk control option considered was 
to require a double side skin. The quantification of costs and benefits were carried 
out by IACS (2001). The key data, from IACS, are given in Table 3.1. The decision 
parameters are now defined in the FSA guidelines as Gross and Net Cost of Averting 
a Fatality, Eqs. (3.1) and (3.2): 


GCAF = ACost/APLL 3.1) 
NCAF = (ACost — ABenefit) /APLL (3.2) 


Table 3.1 Double side skin for new bulk carriers (ACS 2001) 


Cost $ Risk GCAF $ NCAF $ 
reduction million million 
Double Side Skin, 131,000-182,000 41% 0.8-1.1 0.1-0.4 


new bulk carriers 
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PLL is the Potential Loss of Life, ACost is the additional cost of the RCO, 
and ABenefit is the economic benefits resulting from implementing the risk control 
option. 

The clear recommendation for double side skin, given an acceptance criterion of 
$3 million for CAF was later confirmed by UK (2002a). This study claimed many 
commercial benefits of double side skin in addition to the safety benefits which 
resulted in negative NCAF values. Although the IACS study was conclusive, [ACS 
did wait for MSC76 to take the decision, and promised to develop the necessary 
IACS Unified Requirements (UR) for double side skin bulk carriers (MO 2002a). 
IACS could have decided to mandate double side skin for bulk carriers classified by 
the IACS member societies, but finally decided that such decisions should be made 
at IMO level. 

IACS (2002) and UK (2002a) both had included coating in their assessment, and 
both studies produced negative NCAFs. [ACS summarized the situation in the work- 
ing group by stating that the analysis confirmed that it is always in the owner’s best 
interest to properly coat his ships and to maintain coating. However, as explained 
by INTERCARGO, coating of cargo holds can not be easily be regulated, as appro- 
priate coating depends on the cargo. However, MSC noted that SOLAS regulation 
II-1/3-2 made the coating of dedicated ballast tanks mandatory for oil tankers and 
bulk carriers but extending that requirement to cargo holds could introduce seri- 
ous problems, bearing in mind that cargos can react distinctly to different coatings. 
Therefore, MSC agreed that new ships should be required to have their dedicated 
seawater ballast tanks and void spaces within double hull spaces coated according 
to current SOLAS requirements for ballast spaces. The MSC instructed the Design 
and Equipment (DE) Sub-Committee to develop international performance stan- 
dards for coatings. With respect to existing ships, the Committee acknowledged that 
at present there was sufficient control over the condition of coatings through the 
enhanced survey programme and agreed that this risk control option should also be 
addressed by class and the ship owner. 

Control standards of steel repair carried out at terminals, was proposed by UK 
(2002a), and presented with negative NCAFs, but very small risk reducing effects, 
actually an indication that this was mainly of commercial interest. The discussion 
disclosed that the problem could be associated with repair carried out without noti- 
fying the class society. The discussion was inspired by a detailed casualty investiga- 
tion presented by Marshall Island (2002), where this problem was clearly identified. 
MSC agreed to request the DE Sub-Committee to prepare a draft MSC circular to 
remind ship owners and operators of their obligations and responsibilities under SO- 
LAS regulation II-1/3-1, concerning the provision that ships shall be maintained in 
accordance with the structural requirements of recognized classification societies, 
and other related management obligations under the ISM Code. It is clear from the 
discussion that the FSA was not used as a significant contributor to this decision. 

IACS did propose the fitting of a forecastle and presented this as marginally cost 
effective for new building; see Table 11 of [ACS (2001) and Table 3.2. 

MSC noted the information provided by IACS on the on-going development 
of Unified Requirement S28, requiring the fitting of a forecastle on bulk carriers 
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Table 3.2 Forecastle for new bulk carriers 


Cost $ Risk reduction NCAF $ million GCAF $ million 
Capesize 54,000—102,000 0.0211 2.2—4.5 2.6-4.8 
Panamax 29,100—54,000 0.0493 0.2-0.7 0.6-1.1 
Handymax 15,600—5 1,000 0.0933 —4,9 to —2.0 0.2-0.3 


contracted for construction on or after | January 2004 with the purpose of protecting 
foredeck fittings against green sea loads and minimizing the impact of such loads on 
fore hatch covers. The Committee also noted that, while the fitting of a forecastle as 
such was not an IMO requirement, draft Load Lines Protocol regulation 39 — ‘Mini- 
mum bow height and reserve buoyancy’ would require additional reserve buoyancy 
forward consistent with the provision of some sheer and/or a forecastle. This demon- 
strated the advantage of use of common and agreed risk acceptance criteria by IMO 
and IACS. 

The MSC recognized that replacing hatch covers in existing ships would not be 
cost-effective, but agreed that more attention should be paid to hatch cover securing 
mechanisms and the issue of horizontal loads, especially with regard to maintenance 
and frequency of inspection. The Committee agreed that ship owners and operators 
should be made aware of the need to implement regular maintenance and inspec- 
tion procedures for closing mechanisms in existing bulk carriers in order to ensure 
proper operation and efficiency at all times, and instructed the DE Sub-Committee 
to develop standards for hatch cover securing arrangements for existing ships. The 
decision of not strengthening hatch covers on existing ships is not well documented. 
It may be noted that IACS (2001), in Table 12, lists this risk control option as cost 
effective. UK (2002b) also lists this as cost-effective. The reason for not implement- 
ing this risk control option may be found in Japan (2002c), Table 3.1. This table 
shows that UK classified too many accidents as hatch cover related. A scrutiny of 
the data, which was made possible by the exchange of information between UK and 
Japan, resulted in an agreement to reduce the frequency of hatch cover failures in the 
models. This resulted in the conclusion that this risk control option was no longer 
cost effective. This demonstrates the lack of consistency in the approach followed 
at IMO. When such changes in assumptions are made, this should be recorded. 
Retrospectively, it is practically impossible to identify from the documents what 
considerations were finally made.> 

Hold, ballast and dry space water level detectors were already scheduled for im- 
plementation in the new SOLAS regulation XII/12, both for new and existing bulk 
carriers. Both Norway and ICFTU (2001) and IACS (2001) demonstrated this risk 
control option to be cost effective, using very different risk models. After the de- 
cision was made, also UK (2002a) confirmed this. Close comparisons of the FSA 
studies show that all risk models are different — still giving the same result. Earlier, 
at IMO, many delegates had expressed scepticism on FSA by referring to undoc- 


5 The author’s knowledge is as a member of the International Steering Board of the 
UK/International study. 
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umented experience that an FSA can produce ‘any answer’. The case of the water 
level detectors is clear evidence of the opposite. 


3.4.4.5 Note on the Decision-Making Related to Double Side Skin 
for Bulk Carriers 


The review of the FSAs and the main decision were made at MSC 76, agreeing to 
implement double side skin for bulk carrier larger than 150 meters. Further discus- 
sions and drafting of the SOLAS text was carried out at MSC 77, with a plan to 
adopt the regulation at MSC 78. However, at MSC 78, Greece (2004) submitted a 
document ‘Comparative Study of Single and Double Side Skin Bulk Carriers’. 

This report was presented as a review of the previous FSA studies, which had 
been reviewed and formed the basis for the agreement in the working group and 
by the committee at MSC 76. At MSC 78 (during adoption), the IMO procedure 
was to finally decide to adopt the new regulation. During adoption there is actu- 
ally no working group that can review and discuss the new evidence that may have 
been contained in a new submission. The only possibility is a debate in plenary. In 
this case, Greece had succeeded in raising concerns about mandating double side 
skin bulk carriers, and in the voting about adopting the new regulation 32 delega- 
tions preferred not to make double-side skin construction mandatory, but to offer it 
as an optional alternative (at the time some owners were already ordering double 
side skin bulk carriers); 22 delegations voted in favour of making double-side skin 
construction mandatory; and 15 delegations abstained. With this, the mandating of 
double side skin bulk carriers was abandoned, and for many delegates the decision 
confirmed their scepticism towards FSA. 

It appears now that if this report had been reviewed it would not have been ac- 
cepted as basis for decision-making. In retrospective, it is probably most relevant to 
discuss the decision processes at IMO in general. As was indicated by the old case of 
‘solo watch- keeping during period of darkness’ it is always regretted by the analyst 
that any analysis may be ignored in the final political decision process. The protec- 
tion against such political overruling of FSA recommendations could for example 
be a better documentation of which considerations were made during the original 
decision process (in this case at MSC76). As a matter of fact, the problems with the 
current decision process was predicted by the WG/FSA at MSC76, when the dele- 
gation of Liberia had expressed concern regarding the need for better background 
discussion of risk control options (RCOs) prior to recommending adoption by the 
Committee and had brought the group’s attention to Step 5 of the FSA approach: the 
decision-making process. Decision-making was based upon the results of the FSA 
and other factors that may influence the decision. In order for decision makers to 
properly consider an RCO assumption, uncertainties, methodologies and any other 
important factors that may influence the decisions should be properly summarized 
and communicated both verbally and in writing. The delegation of Liberia would 
hope that this issue will be properly considered in future FSAs to allow for greater 
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transparency and facilitate the decision-making process (Quote from (IMO 2002b) 
§5.19, author’s underlining.) 


3.4.5 Ongoing FSA on Electronic Chart Display 
and Information System 


There have been many other FSAs submitted to IMO, and many studies have been 
carried out in national or international research projects. But, as these studies have 
not contained recommendations for decision making they have not been reviewed 
and the content and quality of these studies are not generally known. 

One exception is the studies of navigational safety for large passenger ships and 
a number of follow up studies on the mandatory carriage requirements of Electronic 
Chart Display and Information System (ECDIS). This can be traced back to the IMO 
Chairman’s initiative at MSC72 (IMO Secretary General 1999) that puts large pas- 
senger ships on the agenda of MSC. Norway, responded to this by suggesting that 
FSA studies should be carried out, and volunteered to carry out an FSA on large 
passenger ship safety, hoping that other flag states could carry out FSAs on other 
functions. Unfortunately, Norway ended up as the only flag state that carried out a 
related FSA. This was reported as Norway (2004), and recommended the follow- 
ing RCOs: 
Electronic Chart Display and Information System 
Track Control System 
Automatic Identification System integration with radar 
Improved bridge design 
Improved navigator training 


The recommendations were not followed by IMO, but largely followed up by 
the industry. However, the study resulted in a new study, looking into Electronic 
Chart Display and Information System for practically all ship types. This study was 
initiated by Denmark and Norway (2005), and submitted by Denmark and Norway 
(2006). The study had been carried out by DNV, and this time a Bayesian Network 
model had been used as modelling technique. This very detailed and comprehensive 
study concluded that ECDIS should be made mandatory for most ships, for details 
see Denmark and Norway (2005). The study was confirmed by Japan (2006). The 
following debate has focused on the coverage of Electronic Nautical Charts. These 
questions were answered by very detailed studies by DNV and submitted as Den- 
mark et al. (2007). By programming and counting the likelihood that a ship that 
needed ENC to avoid grounding actually had access to ENC was establishes as 
about 90% (Norway 2008). The coverage is improving rather fast. ECDIS is thus 
expected to reduce the frequencies of groundings by about 1/3 as compared to the 
standard paper nautical charts. The Sub-Committee on Safety of Navigation, NAV54 
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(July 2008) recommend that MSC mandate ECDIS based on these studies. The sub- 
committee made clear recommendations and prepared the relevant amendments to 
SOLAS Chapter V. 


3.4.6 Other Ongoing FSA Studies 


The partially EU funded SAFEDOR project has submitted a series of so called ‘high 
level FSAs’. These studies are quite standard FSAs, focusing on developing detailed 
accident scenarios and estimating the likelihood (using event trees) of the most rel- 
evant accident scenarios. At MSC86, May 2009, MSC is expected to have the fol- 
lowing FSA studies from SAFEDOR on the agenda. 


FSA: LNG ships, Denmark (2007a) 

FSA: Container Ships, Denmark (2007b) 

FSA: Tankers for Oil, Denmark (2008a) 

FSA: Cruise Ships, Denmark (2008b) 

FSA: Ro-Pax, Denmark (2008c) 

FSA: Dangerous Good in Containers (not yet submitted) 


With all these FSAs on the table, it is expected that FSA is re-established as an 
important method for developing Rules and Regulations at IMO level. 


3.5 Discussion on FSA 


3.5.1 FSA Work 


Generally IACS, Japan and Norway/ICFTU demonstrated that rather extensive FSA 
studies may be carried out in about a year’s time. If well coordinated a compre- 
hensive FSA study of a ship type may take two to three years, as was the case for 
some of the FSAs in SAFEDOR. The reason is that many ship types are more com- 
plicated to analyse, more modelling work and search into reliability and incident 
data may therefore be required. Bulk carriers and oil tankers are particularly sim- 
ple designs, there are large fleets of these ships, and there have been (too) many 
accidents that make up the experience/casualties base. Thus, FSA studies may be 
carried out within the time span that is normally available at IMO for such tasks, 
namely two to three years if a dedicated working team is in place to complete 
the tasks. 
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3.5.2 FSA Methods 


Most FSA studies presented at IMO have used standard risk models using fault 
and event trees. Fault trees have not been until now very detailed. When detailed 
fault trees have been prepared, e.g. by France (2002) as part of the UK/International 
project on bulk carrier safety, then the analysts have sometimes given up on populat- 
ing the fault trees with relevant data. This happened also with the UK/International 
study, which ended up without using fault trees for the risk modelling except 
for splitting up the initiating events into causes. The result of this was that the 
UK/International study had no models for quantifying risk reduction, but resorted 
to expert judgement of risk reducing effects for each event tree scenario. 

Both IACS (2001) and Japan (2002b) used rather detailed structural reliability 
models to be able to quantify risk reducing effects; Norway and ICFTU (2001) used 
also detailed fault and event trees populated by data from many sources also from 
outside shipping; the FSAs on navigation safety have used Bayesian Networks as 
the modelling tool. 


3.5.3 Open Issues 


There are some issues that are still unresolved and subject to debate. For example 
there seems to be two different views on the use of NCAFs and GCAFs. When 
risk reduction is small and economic benefits are large, this may result in a large 
negative NCAF. Some seem to conclude that such risk control options should be 
implemented in mandatory instruments, whilst others are of the opinion that there 
is no need to regulate, as it is reasonable to assume that the owner can take care of 
his own economic interest. At MSC76, various questions relating to coating came 
in this category. All studies showed that it is in the owner’s best interest to coat and 
maintain coating, and that this also have safety implications. Still it was decided to 
regulate this at IMO level. 

There are also controversies on how FSA studies should be verified. The verifica- 
tion of the FSA on helicopter landing areas (HLA) for non-Ro-Ro passenger ships 
was a case of detailed verification. The international FSA on bulk carrier safety was 
not verified. The study was open to anyone, but there are no records of any inde- 
pendent verification. Following a proposal by IACS (2004), there is now an agreed 
review procedure. 

Finally, the risk acceptance criteria will be an issue of future discussions. The 
criteria on safety have been agreed, but on environmental risks there have so far 
only been a few proposals on how to deal with this issue. 
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3.5.4 Risk Acceptance Criteria 


The FSA guidelines are sufficiently specific on the format of the risk acceptance cri- 
teria for safety relating to loss of life. Individual risk and societal risks are supposed 
to be analyzed, and societal risk should be presented as FN diagrams. The ALARP 
criterion is referred to and criteria have been given for intolerable risk or negligi- 
ble risk. In reality the proposal by Norway (2000) has been adopted. However, the 
numbers used for the cost-effectiveness analysis need to be updated. For example 
all cost/benefit ratios have been given in US$, a currency that has lost more than 1/3 
of its value against other currencies since year 2000. Norway (2000) concluded that 
most ship types (including bulk carriers) are in the ALARP area, and that cost ef- 
fectiveness criteria should be used to reach a final recommendation. In the decision 
making process at IMO, this criterion was referred to and all risk control options 
were implemented with a cost of averting a fatality less than $3 million. This is the 
criterion suggested by Norway (2000) in cases where a fatality is used as an indica- 
tor; which in addition to representing the fatality risk also represents a mix of severe 
and serious injuries. 


3.5.5 The FSA Process 


Most risk analysts see the FSA process as a method to coordinate all activities re- 
lating to the decision making process. This is still not a widespread view in the 
maritime industry. A number of risk issues with large cost implications have been 
put on the agenda during the last couples of years, without considering FSA studies. 
For example, both security issues and large passenger ship safety issues have been 
considered without FSA. 

Even during the decision making process for bulk carriers, there were a number 
of risk control options implemented without FSA, for example issues relating to 
the revision of the Load Line Conventions or the UK proposal to strengthen all 
bulkheads on existing bulk carriers (UK 2002c). Furthermore a large number of 
separate studies, e.g. results from model tests were never integrated into the FSA 
studies, although some studies used structural reliability models that could easily 
include e.g. new hatch cover load distributions in the risk estimation and estimation 
of risk reduction. 


3.6 Conclusions on FSA 


It took the maritime industry seven years from the completion of the first version 
of the FSA guidelines before the first major decisions were made based on the new 
decision making tool. There have been some failures with using the new tool, but 
the industry is learning relatively fast. Attempts to make FSA something different 
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from a standard risk based decision making method have failed, and focus seems 
now to be shifting towards educating more people to use the new tools, rather than 
‘inventing the wheel’ again. 

There is still a lot to be done relating to verification, risk acceptance, data collec- 
tion and methods for integrating all relevant knowledge. This is probably going to 
take many more years. 


3.7 Goal Based Standards 


The new item on the agenda for the International Maritime Organisation’s (IMO) 
Maritime Safety Committee (MSC) — “Goal-Based New Ships Construction Stan- 
dards’ — was introduced at the MSC78 in May 2004 and it has been an MSC agenda 
item ever since, with a dedicated Working Group in place. GBS is expected to stay 
on the IMO agenda for the next years. This agenda item was introduced by the 
Bahamas and Greece in a paper to the IMO Council (Bahamas and Greece 2002). 
In this paper, the Bahamas and Greece argue that the IMO should play a greater role 
in determining the construction standards to which new ships are built, a role tradi- 
tionally delegated to the classification societies, and that this should be incorporated 
into the IMO Strategic Plan. Many flag states opposed the proposal as they did not 
see any compelling need for it. However, the Bahamas and Greece prevailed. 

The initiative was also surprising, as FSA also will tend to result in goal based 
standards, as the goal (or the safety objective of a regulation) is made explicit. By 
making the goal explicit it is also easier to deal with innovative and risk based de- 
sign, as the prescriptive rules are seen as a means to achieve the goal (for standard 
design solutions), but in principle the goal may be achieved by any other design 
solution that can be documented to meet the goal (the risk acceptance criteria). This 
would open opportunities for risk based design. Some classification societies had 
already started to use the FSA guidelines as basis for own rule development, and 
saw clear benefits of having more well-defined criteria to relate to. 

There are also new elements introduced in the regulatory process, by formalizing 
a Goal Based Approach. This relates to the style of writing regulations: Rather than 
stating in prescriptive form how ships should be built and equipped, the regulations 
focus on the goals, the purpose of the regulation, what should be achieved, rather 
than how to achieve it. This affects the structure of the regulations, and helps keeping 
a well-defined structure to the regulation. This is an attractive idea, as the current 
regulatory system is extremely complicated, and is becoming ever more complicated 
due to a continuous amendment process. 

The structure of the goal based regulatory system as tentatively agreed at MSC84 
(May 2008) is shown in Fig. 3.4. It is noted that Tiers I, Il and HI represents the GBS 
to be maintained at IMO level, and includes a verification process that e.g. classifi- 
cation rules, being an example of Tier IV, should be verified to meet the goals for 
one or more functional requirements. 
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Fig. 3.4 Goal based standards framework 


3.7.1 Definition of GBS 


According to the current definition, IMO goal-based standards are: 


1. broad, over-arching safety, environmental and/or security standards that ships are 
required to meet during their lifecycle; 

2. the required level to be achieved by the requirements applied by class societies 
and other recognized organizations, Administrations and IMO; 

3. clear, demonstrable, verifiable, long standing, implementable and achievable, ir- 
respective of ship design and technology; and 

4. specific enough in order not to be open to differing interpretations. 


3.7.2 Tier I: Goals 


Currently a draft text is available only for ship construction and the goals (Tier I) 
are expressed as follows: 
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Ships are to be designed and constructed for a specified design life to be safe 


and environmentally friendly, when properly operated and maintained under the 
specified operating and environmental conditions, in intact and specified damage 
conditions, throughout their life. 


il 


Safe and environmentally friendly means the ship shall have adequate strength, 
integrity and stability to minimize the risk of loss of the ship or pollution to 
the marine environment due to structural failure, including collapse, resulting in 
flooding or loss of watertight integrity. 


. Environmentally friendly also includes the ship being constructed of materials 


for environmentally acceptable dismantling and recycling. 


. Safety also includes the ship’s structure being arranged to provide for safe access, 


escape, inspection and proper maintenance. 


. Specified operating and environmental conditions are defined by the operating 


area for the ship throughout its life and cover the conditions, including interme- 
diate conditions, arising from cargo and ballast operations in port, waterways and 
at sea. 


. Specified design life is the nominal period that the ship is assumed to be exposed 


to operating and/or environmental conditions and/or the corrosive environment 
and is used for selecting appropriate ship design parameters. However, the ship’s 
actual service life may be longer or shorter depending on the actual operating 
conditions and maintenance of the ship throughout its life cycle (End quote). 


Many have proposed to simply add a reference to the ALARP principle, and the 


FSA Guidelines to make these goals risk based (and possible to understand in prac- 
tical application to rule development). Since the FSA Guidelines already contains 
the risk evaluation criteria this would be sufficiently clear to a rule developer. 


3.7.3 Tier IT: Functional Requirements 


The first three of the so-called functional requirements, are given below: 


Tier II (Functional Requirements) 
(Applicable to new oil tankers and bulk carriers in unrestricted navigation) 
Design 


II.1 Design life 


The specified design life is not to be less than 25 years. 


I.2 Environmental conditions 


Ships should be designed in accordance with North Atlantic environmental 
conditions and relevant long-term sea state scatter diagrams. 


II.3 Structural strength 


Ships should be designed with suitable safety margins: 


1. to withstand, at net scantlings, in the intact condition, the environmental 
conditions anticipated for the ship’ design life and the loading conditions 
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appropriate for them, which should include full homogeneous and alternate 
loads, partial loads, multi-port and ballast voyage, and ballast management 
condition loads and occasional overruns/overloads during loading/unloading 
operations, as applicable to the class designation; and 

2. appropriate for all design parameters whose calculation involves a degree of 
uncertainty, including loads, structural modelling, fatigue, corrosion, mate- 
rial imperfections, construction workmanship errors, buckling and residual 
strength. 


The structural strength should be assessed against excess deformation and 
failure modes, including but not limited to buckling, yielding and fatigue. Ulti- 
mate strength calculations should include ultimate hull girder capacity and ul- 
timate strength of plates and stiffeners. The ship’s structural members should 
be of a design that is compatible with the purpose of the space and ensures a 
degree of structural continuity. The structural members of ships should be de- 
signed to facilitate load/discharge for all contemplated cargoes to avoid dam- 
age by loading/discharging equipment which may compromise the safety of 
the structure. 

II.4 Fatigue life 
The design fatigue life should not be less than the ship’s design life and should 
be based on the environmental conditions in II.2 (end quote). 


Already at this stage, there are many challenges, as seen from a risk perspective. 


1. 25 years design life. In practice this is strongly dependent on maintenance, and 
outside control of the regulator; but in any case most ships are designed to have 
an economic life of 25 years. But the actual life depends on many commercial 
issues, like e.g. the market situation: At times with high day-rates there is no 
scrapping. The term ‘design life’ does not play any important role in classifi- 
cation rules. The 25 years used in classification rules rather refers to the return 
period for extreme loads (which is a different concept than the design life). 

2. Bulk Carriers and Tankers are today designed to 20 years North Atlantic ex- 
tremes loads. To change this to 25 years has almost no effect. 

3. Suitable safety margin? This is where a risk based approach becomes useful, as 
Structural Reliability Analysis could be used to calibrate the Rules to the relia- 
bility level defined. 

4. Fatigue life equal to design life. This statement must be based on a non-standard 
definition of fatigue life (corresponding to about 2.27% probability of failure for 
each ‘hot spot’). With hundreds of hot spots this probability appears too high. 


These few examples demonstrate that rules today should be better based on a 
risk based approach. It is not possible to seriously discuss safety, without using risk 
concepts. The example relating to hull girder ultimate strength was prepared based 
on work of H@rte et al. (2007) and internal work in DNV for IACS (2006). 

The role of FSA and Structural Reliability Analysis in the GBS Framework is a 
rational way for the justification of the rules and regulations. These analyses can be 
subject to verification. The final formulation of the rules and regulations is, however, 
usually not possible to be verified. The tendency for those supporting a prescriptive 
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approach to GBS is to write detailed verification requirements (in Tier II), rather 
than leaving it to the developer of the rules/regulation to justify their development. 


3.8 Risk Acceptance 


3.8.1 Methods to Justify Criteria 


There are many methods to establish risk acceptance criteria, and this is a continuing 
debate in the scientific community; but there are, also, intense political and public 
debates on these issues. New ways of reasoning may still appear and gain support. 
For example the new method described in Skjong and Ronold (1998) is regarded as 
a breakthrough for setting target reliabilities in structural reliability applications by 
Rackwitz (2001), as compared to the more classical approach used in DNV (1992) 
and Skjong et al. (1995). For a discussion, see Skjong (2002), Ronold and Skjong 
(2002) and Skjong and Bitner-Gregersen (2002). Currently, the main methods for 
defining criteria are: 

Compare with other hazards. This implies that a comparison is made with rel- 
evant criteria of other industries that are felt to represent a reasonable target, and 
where the documentation is good. This approach may lead to some learning from 
other industries, which could add benefits. However, the method must be used com- 
petently. For example, ships may compare unfavourably on a passenger-kilometre 
scale and well on a ton-kilometre scale if compared to airplanes. The aircraft in- 
dustry seldom presents FN diagrams, as in plane accidents the result is often no 
survivors in many accidents. 


Shipping should be as safe as road transport 


Compare with natural hazards. The idea is to compare things we do to ourselves 
with things done to us by Nature (God). It is generally a goal in using this approach 
that what we do to ourselves should be a small portion on what we can blame on 
Nature (God). The problem with this is that the distinction is not very clear. If a 
ship is designed to survive the twenty year North Atlantic extreme wave, and than 
meet an even higher wave resulting in structural failure, that is hardly an act of God, 
although the insurance company accept it as such. 


Risks posed by human activity should be smaller than those posed by nature 


Compare with risks we normally take. We do a number of things that are hazardous, 
like crossing the street, driving cars, repairing the roof, and sport activities. We 
do not consider these activities dangerous, but in reality they are more risky than 
a number of individual work related risks. This is usually phrased as ‘The most 
dangerous place to be is at home’. This statement is largely verified by statistics for 
most white-collar workers. 


Risk that are smaller than staying at home may be accepted 
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Compare with previous decisions. An acceptable risk is always implicit in any build- 
ing code, road standard, train safety standard etc. It is possible through analysis of 
data or by risk models to find the implicit risk. By comparing to standards that are 
accepted as ‘high quality’, we may arrive at an evaluation criterion. As building 
codes are calibrated according to ISO/CEN structural reliability standards, the im- 
plicit criteria will be replaced by explicit and known criteria. 


Risks that are smaller than in current building codes may be accepted 


Compare with well informed decisions made in democratic forums. From time to 
time risk assessment is carried out and presented to national parliaments and is 
subject to extensive review and public debate. When a decision is finally made the 
value judgement on ‘barely acceptable’ or ‘barely unacceptable’ is disclosed in risk 
terms. This may be used as evaluation criteria in later risk studies. 


Risk associated with the construction of the National Natural Gas Power Station is barely 
acceptable 


3.9 Decision Parameters 


In principle, different decision parameters may be used, and will be used un- 
less some standardisation effort is undertaken. The advantage of standardisation is 
e.g. that 


— the FSA team knows what to document, 

— the decision makers know what to ask for, 

— information are collected from many analyses in the same format, 

— previous decisions may be compared to current and future decisions, 
— risk based design may be based on the same criteria, 

— the high level goal in a GBS is defined 


The risk evaluation criteria are normative statements or value judgements, as 
opposed to a statement about risk, which ideally should be objective statements 
of probabilities and consequences. Applications of FSA have disclosed such value 
judgements, and in Skjong et al. (2005) there is an extensive list of RCOs imple- 
mented and not-implemented with associated cost effectiveness. If evaluation crite- 
ria are not made explicit, the FSA may be used to disclose the value judgement. In 
this chapter generic risk results for the common ship types are shown together with 
the evaluation criteria to indicate the effect of the criteria proposed and used at IMO. 

To make a well-informed decision about the possible implementation of a new 
regulation, a new risk control option, or possible deletion of an obsolete regulation, 
many different decision parameters may be necessary. In the FSA Guidelines the 
following decision parameters may be identified, or are suggested: 


— Individual risk for a crew member (individual risk is risk of death, injury and ill 
health) 
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— Individual risk for a passenger (if relevant) 

— Individual risk to third parties (as appropriate) 

— Societal risk in terms of FN® diagrams for crew members 

— Societal risk in terms of FN diagrams for passenger (if relevant) 

— Societal risk in terms of FN diagrams for third parties (as appropriate) 

— Costs of each risk control options should be presented together with the effect on 
the six items above. 

— The Gross Costs of Averting a statistical Fatality (GCAF) should be presented. 

— The cost of reducing risk of injuries and ill health, should be presented (see dis- 
cussion below) 

— Incases where the risk control options can not be justified purely for safety rea- 
sons, the net economic benefit may be subtracted from the costs, and the Net 
Cost of Averting a Fatality (NCAF) should be presented’. 


The risks and risk control options should fulfil all the criteria associated with the 
decision parameters above. 

Further criteria for environmental protection needs to be developed. Alterna- 
tively, all environmental consequences could be transferred to monetary units, and 
included in a cost benefit assessment, but this also requires an agreed way of con- 
verting pollution averted into monetary units. The only criteria presented to IMO 
are cost effectiveness criteria for evaluating measures to reduce oil-outflow. The 
criterion is presented below. At IMO there are no agreed criteria. 

For each type of the individual risks (i.e. the risk to an individual person) the risk 
of death, injury and ill health should be presented separately. An integrated indica- 
tor may also be presented as Equivalent Fatalities or the Disability Adjusted Life 
Year (DALY), see below. As different integrated indicators exist, the presentation of 
separate results should always be made. In case only fatality rates are presented it 
must be made clear if this implies that risk of injury and ill health are implicit in the 
numbers or explicitly excluded from the analysis. This will affect the risk evaluation 
criterion used (see below). 

In evaluation of a specific risk control option, results before and after imple- 
menting the risk control options should be presented. For each of the societal risk 
evaluation criteria, results should be presented separately and added together. 


3.10 Risk Evaluation Criteria 


The standard term used for risk evaluation criteria is ‘risk acceptance criteria’. The 
term is well established in many industries and regulations. In shipping, IMO has, 
however, decided to use the term risk evaluation criteria to indicate that the criteria 


© EN diagrams are plots of frequency (F) of N or more fatalities. FN diagrams are displayed in 
log-log scale. 


7 Tf the net benefit is large, it may be recommended not to regulate, as the market will regulate this. 
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will not be used as the only decision criteria. Other considerations may also be 
appropriate. 

In general risk evaluation criteria may be implicit or explicit, and they may be of 
high-level or low-level. The technical equivalency in Regulation 5 of SOLAS Chap- 
ter lis an example of a low-level implicit criterion (technical equivalency without 
knowing the safety). Acceptance of equivalency may also be given based on safety 
equivalency. This would be a high-level implicit criterion. As the safety is not known 
in current regulations, i.e. is implicit, safety should first be established by analysis of 
previously accepted ships designs, i.e. made explicit. Thereafter safety equivalency 
may be demonstrated for a new solution. 

It should be noted that without explicit safety objectives, it is not obvious what 
safety equivalency should imply. E.g. should the probability of a catastrophic acci- 
dent vary with the ship size, number of passengers etc.? Does safety equivalency 
relate to individual risk or societal risk? In general, a number of interpretations may 
be possible. 


3.11 Explicit Risk Evaluation Criteria — Individual Risk 
of Death, Injury and Ill Health for Passengers, Crew 
and Third Parties 


3.11.1 Purpose 


The purpose of individual risk evaluation criteria is to limit the risks to people on- 
board the ship or to individuals who may be affected by accidents. The criteria 
should define the term ‘intolerable and negligible level of risk’ in terms of the indi- 
vidual risks of death, injury and ill health. 


3.11.2 Background 


Modern risk assessment practice is to use an individual risk criterion that defines 
the intolerable and the negligible (broadly acceptable) risk. These criteria are lim- 
its to the area where cost-effectiveness assessment may be applied, as intolerable 
risks must be reduced irrespectively of costs. The area where cost-effectiveness as- 
sessment may be applied are commonly referred to as the As Low As Reasonably 
Practicable (ALARP) area. In this area risks should be reduced as long as the risk 
reduction is not disproportionate to the costs. To reduce risks beyond where risk 
reduction is disproportionate to the costs is not reasonable. The cost-effectiveness 
criteria therefore define what is reasonable (in terms of R in ALARP, see section 
about Cost-Effectiveness below). 

There is no single universal level of acceptable individual risk. People are pre- 
pared to accept a wide variety of risks depending on their own perception of the 
risks and benefits from the activity. In general, higher risks are accepted if the risk is 
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voluntary, ordinary, natural, the effects are delayed and the individual consider that 
they have control. These factors may explain why high risks are commonly accepted 
in some sports, in driving cars and motorbikes, and in certain hazardous occupations 
where risk control depends on the individual’s own skill (e.g. flying, diving). 

When people are exposed to risks over which they have little or no control, they 
rightly expect that the appropriate authorities impose control on their behalf. It is 
these ‘involuntary’ risks which risk evaluation criteria are developed to control. An 
appropriate level for the risk evaluation criteria would then be substantially below 
the total accident risks experienced in daily life, but might be similar to risks that 
are accepted from other involuntary sources. 

Individual risk criteria for hazardous activities are often set using the risk levels 
that have been accepted from other industrial activities. This involves a judgement 
that the acceptability of individual risks is similar for all activities over whose safety 
the person exposed has little or no control. Thus, risk criteria for ship’s crew could be 
similar to those for land-based industries e.g. manufacturing and offshore industries. 
This implies that risk criteria that have already been developed in other industries 
can be applied to ships. 

In principle there are many different methods that may be used to set the limit of 
tolerable risk as mentioned previously. By comparing to other industries Tables 3.3 
and 3.4 are relevant. Comparing to natural hazards a risk evaluation criterion of 10-7 
per ship-year for crew may be suggested. The number can be traced back to a time 
when the annual fatality rate (for all reasons) in the period of life when this is at its 
lowest (4-15 years of age) was about 1077 in OECD member countries. Today this 
figure is down to 2- 10~+ in some countries. This was used by many regulators as 
an intolerable limit. For passengers it is common to use a stricter criterion, because 
the passengers are less informed about the risks, they are not compensated (but 
pay), and are less in control. A negligible or ‘broadly acceptable’ criterion of 10~° 
should be understood as a very small number representing an insignificant risk to an 
individual. If exposed to only such risks an individual would live in the order of a 
million years. 

Crew-members on a ship should have more influence over the risks and should 
be better informed than passengers or members of the public near the port. It is 
therefore common to treat occupational risk (crew) differently than transport related 
risk (passengers). 


3.11.3 Individual Risk Criteria 


Based on the considerations above individual risk criteria were proposed Norway 
(2000) for ships, based on those published by the UK Health & Safety Executive 
(HSE 1999). This was agreed at IMO. 


Maximum tolerable risk for crew members 10-3 annually 
Maximum tolerable risk for passengers 10-4 annually 
Maximum tolerable risk for public ashore 10-4 annually 
Negligible risk 10~° annually 
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Table 3.3 Individual risk criteria 


Authority Description Criterion (annual) 
HSE (1999) Maximum tolerable risk to workers 10-3 
Maximum tolerable risk to the 10-4 
public 
Negligible risk 10-6 
Netherlands Maximum tolerable for existing 10-> 
(Bottelberghs situations 
1995) Maximum tolerable risk for new 10-6 
situations 
New South Wales, Sensitive developments (hospitals, 5.1077 
Australia (DUAP schools etc.) 
1997) Residential, hotels, motels, tourist 1-10~-° 
resorts etc. 
Commercial, retail, offices etc 1-10-> 
Sporting complexes, active open 1-10->> 
space 
Industrial 5-10-> 
Western Australia Sensitive developments (hospitals, 5.1077 
(EPA 1998) schools etc.) 
Residential zones 1-10~6 
Non-industrial (commercial, 1.1075 
sporting etc.) 
Industrial 5-109 


Table 3.4 Individual risk in various industries and activities, Mathiesen (1997) 


Industry Annual individual risk (x 10>) 
Oil and gas production 100.0 
Agriculture 719 
Forestry 15.0 
Deep sea fishing 84.0 
Energy production 2.5 
Metal manufacturing 5:5 
Chemical industry 2.1 
Mechanical engineering 1.9 
Electrical engineering 0.8 


Risks below the tolerable risk but above the negligible level should be made 
ALARP by adopting cost-effective risk reduction measures. Other regulators use 
similar or slightly different criteria. 

The maximum tolerable criteria specified above are not particularly strict, and 
it may be required that all ships should meet them. When a comprehensive FSA is 
carried out for new ships, it may be appropriate to have a more demanding target, 
which should be met. 
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These may be indicated as follows (proposed by Norway (2000) and agreed at 
IMO): 


Target individual risk for crew members _10~* annually 
Target individual risk for passengers 10-> annually 
Target individual risk for public ashore 10-> annually 


Although it is not necessarily essential to have risks below these targets, failure to 
meet them would suggest that cost-effective risk control options might be available. 
New regulations based on an FSA should demonstrate that the new ships meet these 
targets, and that risks are ALARP. 

Regarding the individual risk evaluation criteria for public ashore, indications 
of risk levels are given above. However, the responsible national authorities should 
decide on the individual risk evaluation criteria for public ashore. 


3.11.4 Comparison with Historical Data 


Figure 3.5 shows the estimated average individual risk for crews from different ship 
types in the period from 1978 to 1998 (Eknes and Kvien 1999). The data source is 
the LMIS casualty database, representing the ship accidents, and excluding personal 
accidents. The figures indicate that, unless personal accidents dominate, the individ- 
ual fatality risk levels in the maritime industry, according to the proposed criteria, 
fall in the ALARP region, where risk control options should be introduced if they 
are cost effective. Indications are that the number of personal accidents account for 
a similar risk as the ship accidents. This being the case, the total individual risk may 
be close to intolerable for some ship types. There may be exceptions among sub- 
groups of ship types investigated or ship types that have not been investigated, such 
as tug boats and fishing vessels. 
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Fig. 3.5 Individual fatality risk (annual) for crew of different ship types, shown together with the 
proposed individual risk evaluation criterion (data from 1978 to 1998, data source: LMIS/Ship 
accidents). As the data is from LMIS the personal accidents are not included 
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For individual risks of injury and ill health similar evaluation criteria may be de- 
veloped by comparing to other industries and transport. For example, if a significant 
proportion of the crew is injured or develops similar health problems, this should be 
regarded intolerable. What is significant may be judged by comparing to statistics 
representing larger populations. No explicit criteria have been proposed. 

Further, for an explicit treatment of risk of injuries and ill health more explicit 
criteria should be based on cost-effectiveness considerations (see the section about 
cost-effectiveness below). Except for such obviously intolerable cases a criterion 
based on cost effectiveness is more appropriate for explicit studies of risks of injuries 
and ill health, see below. 


3.12 Explicit Risk Evaluation Criteria — Societal Risk to Life 
for Passengers, Crew and third Parties 


3.12.1 Purpose 


The purpose of societal risk evaluation criteria is to limit the risks from ships to 
whole crews, groups of passengers or the society as a whole, and to local commu- 
nities (such as ports) which may be affected by ship activities. As the term is used 
at IMO, other regulators might use the term group risk. In particular, societal risk 
evaluation criteria are used to limit the risks of catastrophes affecting many people 
at the same time, since society is particularly concerned with such events. In effect, 
the criteria define the term ‘acceptable level of risk’ in terms of the overall societal 
risks of fatalities. 


3.12.2 Background 


In general, societal risk evaluation criteria, and the societies’ risk aversion against 
large or catastrophic accidents may be considered as lacking an explicit rationale. 
Some risk analysts would count the risk aversion against large accidents as one of 
the ‘risk conversion factors’ representing and defined as the bias ‘perceived risk’ 
divided by ‘actual risk’. E.g. Litai (1980) is listing the following factors affecting 
this bias: Volition, Severity, Origin, Effect Manifestation, Exposure Pattern, Con- 
trollability, Familiarity, Benefit and Necessity. The factors are found to be similar to 
factors addressed by Rowe (1977), Starr (1969), Kinchin (1978), Otway and Cohen 
(1975) and Green et al. (1998). Although the rationality may be debated, societal 
risk criteria are used by a large number of regulators. The problems of inconsis- 
tency are, however, often seen and debated. 

FN diagrams may be established in similar ways as individual risk criteria. 
However, comparison with other industries may result in unpredictable and illogical 
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results. The societal risk evaluation criteria should reflect the importance of the ac- 
tivity to society. For example, the evaluation criteria used for a single fishing vessel 
should be different from the whole transport sector in a country. To formalise such 
observations an FN evaluation criterion may be established by considering the eco- 
nomic activity represented by the different ship types. This may vary by orders of 
magnitude. The examples given for some ship types show that when the importance 
to the society is accounted for, the established FN evaluation curves vary within 1—2 
orders of magnitude. The outlined method (Skjong and Eknes 2001, 2002) may be 
used for any type of activity above a certain size. An obvious limitation of the prin- 
ciple is represented by activities of high economic value with low labour intensity 
in remote places, e.g. offshore oil production. It should be the added value by the 
activity that is included. 

The objective of the outlined method is to establish transparent FN risk evaluation 
criteria with a more rational foundation, which may be established from factual and 
available information. This way the criteria would be transparent as required in IMO 
(1997, 2001). 


3.12.3 Method 


The evaluation criteria may be associated with the economic importance of the ac- 
tivity in question, and calibrated against the average fatality rate per unit economic 
production. The importance of an activity may be measured most adequately in eco- 
nomic terms, assuming that what is paid in an open market on average represents the 
importance. Similarly, Gross National Product (GNP*) is an aggregated indicator of 
the economic activity. Societal risk associated with an activity may be accepted ac- 
cording to the importance to society of the activity. 

For occupational accidents the aggregated indicator g, may be defined as the av- 
erage fatality rate per unit GNP. For transport related accidents a similar aggregated 
indicator, r may be defined. 


Number of occupational fatalities 
q GNP 


crew 


__ Number of fatalities due to transportation 
Contribution to GNP from transportation 


passengers 


By using data from US and Norway on occupational fatalities ¢ = 1.0 fatalities/$ 
billion may be estimated for the occupational fatalities and r = 5.73 fatalities/$ 
billion may be estimated from statistics for scheduled air traffic (ICAO 1995; Skjong 
and Eknes 2000, 2001). These numbers are in need for regular updates based on new 
statistics, both with respect to airplane accidents and economic values. Air traffic 


8 GNP = An estimate of the total money value of all the final goods and services produced in a 
given one-year period by the factor of production owned by a particular country’s residents. 
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is selected for comparison because of the availability of good statistics, and the 
generally high safety standards. 

For a specific activity (e.g. a ship), an average acceptable Potential Loss of Life 
(PLL,) may be based on the Economic Value (EV) of the activity. 


PLL, = q- EV for crew/workers 


PLL, =r-EV for passengers (3.3) 


This states that largely the total occupational risk should be distributed between 
the different activities accounting for their contribution to GNP, and that large de- 
viations from this should be assessed. A similar criterion should be established for 
a transport activity. For activities and trades, which are of less importance to the 
society, the society may not be willing to accept a high accidental fatality risk. For 
activities and trades of minor significance, and with minor contribution to the ser- 
vice production, only minor risks should be accepted. As the ultimate solution the 
fatality risk may be eliminated, by eliminating the activity itself. This way a safety 
budget would be established. E.g. a low economic importance corresponds to a low 
PLLy. 

FN curves are commonly regarded as useful tools. An FN curve with inclination 
b on log-log scale may be fitted to the resulting PLL, by: 


N 
a 1 (N+ 1) 
PLL~a= ) Nfn=Fi 3.4 
A= > Nin (gat 5 Sak) (3.4) 
Here WN, is the upper limit of the number of fatalities that may occur in one 
accident. For a ship this is well defined as the maximum number of crew/passengers 


Jw frequency of occurrence of an accident involving N fatalities 
F, frequency of accidents involving one or more fatalities 


Following the recommendation by HSC (1991), HCGPD (1983) and Statoil 
(1995), b = 1 is chosen, and the above simplifies to: 


Nu 


Nu-1 
— 1 
PLEA =F,\ 1+ ay = 3.5 
‘A (145 N wa) Fy (3.5) 


Some risk analysis practitioners are of the opinion that b = 1 is not risk averse. 
This is wrong, as explained in details in HSE (1991). The risk aversion may be 
understood by observing that small contributions to PLL come from large N. Since 
these small contributions are as ‘intolerable’ as the comparable large contributions 
from small N, the b = 1 is risk averse. 

If solved with respect to F), Eq. (3.5) gives 


PLLA 
Nu 


>; wor 
n=1N 


Fi= (3.6) 
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The ALARP region is introduced by assuming that the risk is intolerable if more 
than one order of magnitude above the average acceptable and negligible (broadly 
acceptable) if more than one order of magnitude below the average acceptable. 
This implies that the region where risks should be reduced to As Low As Rea- 
sonably Practicable (ALARP) ranges over two orders of magnitude, in agreement 
with many published FN evaluation criteria, e.g. HSE (1999), HKGPD (1983) and 
Statoil (1995). 


3.12.4 Examples of Criteria and Comparison with Data 
for Some Ship Types 


Figures 3.6, 3.7 and 3.8 below show FN data for different types of ships, tankers, 
bulk carriers, container vessels, and passenger Ro/Ro vessels. The FN curves are 
based on data from LMIS (1999). The figures also show the societal risk evaluation 
criteria established by the method outlined above. The tankers, bulk carriers and 
container vessels were all assumed to have an average crew size of 20. Based on 
data from Clarkson Research Studies (1999) the average annual turnover for the dif- 
ferent tankers was estimated to approximately $5 million, while the average annual 
turnover for bulk carriers and container vessels was estimated to approximately $2.5 
million. For the passenger Ro/Ro vessels, the evaluation criteria are based on data 
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Fig. 3.6 FN curves for different tankers, shown together with established risk evaluation curves. 
Data from 1978 to 1998. (Data source: LMIS) 
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Fig. 3.7 FN curves for bulk and ore carriers, and container vessels, shown together with risk 
evaluation criteria established by the above outlined method. Data from 1978 to 1998. (Data 
source: LMIS) 


for a fleet of only 7 vessels. A passenger Ro/Ro vessel with a crew size of 140 and 
annual turnover of $50 million gives a societal risk evaluation criterion for crew as 
shown in Fig. 3.8. A societal risk evaluation criterion for passengers as shown in 
Fig. 3.8 results when considering a vessel carrying 1,900 passengers at annual oper- 
ating revenue from tickets of $16 million. In an FSA all data above must be updated 
to current figures, but avoiding to use e.g. figures from time periods with extremely 
high profits. 

The historical data appears to give FN curves in the ALARP region for most of 
the examined ship types. The bulk carriers are different, apparently touching the bor- 
derline between the ALARP and the intolerable risk region. This may be observed 
to be in agreement with the concern behind the attention that has been given to bulk 
carriers’ safety in recent years that calumniated with the many decisions to improve 
bulk carrier safety (described above), where the impression has been that the num- 
ber of losses of these ships involving many fatalities has been judged as intolerable. 
For bulk carriers, the FN curve above is now outdated. For bulk carriers the curve 
is in agreement with the previous published FN curve by Mathiesen (1997) which 
was derived by other methods. For Passenger Ro/Ro Vessels the curve presented is 
in agreement with the FN diagram published by the North West European Project 
on Passenger Ro/Ro Vessels (DNV 1997b). 
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Fig. 3.8 FN curve for passenger Ro/Ro ships, shown together with risk evaluation criteria estab- 
lished by the above outlined method. Data from 1989 to 1998. (Data source: LMIS) 


3.12.5 Third Parties 


On safety issues there will always be a conflict between the interests of third parties 
and industries, as the third parties will be involuntarily exposed to the risks from 
the industry. The shipping industry is not an exception. It should be the national 
authorities’ responsibility to define maximum tolerable and negligible third party 
risk, to protect the citizens. 


3.12.6 Cost Benefit and Cost Effectiveness Assessment 


3.12.6.1 Purpose 


The type of risk criteria proposed above may define a range within which the risks 
should be reduced to a level ‘as low as reasonably practicable’ (ALARP). Within 
this range cost effectiveness assessment is recommended used to select reasonably 
practicable risk reduction measures. 

The purpose of the cost effectiveness criterion will be to provide a basis for 
decision-making about risk control options resulting from FSA Step 3, see FSA 
Guidelines. 
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3.12.6.2 Background 


Currently many IMO decisions and other decisions have been made within the 
maritime industry based on FSA. Early versions of these decisions are listed in 
Table 3.5, a comprehensive list may be found in Skjong et al. (2005). When a de- 
cision is made to implement a risk control option the ‘>’ is used to indicate that 
‘a statistical fatality averted is worth more than $10 million’. It is seen that there 
are no inconsistencies at IMO level, and based on early well-founded decisions the 
criterion is in the range $1.5 million to $5 million. 

Initially IMO decided to require Helicopter Landing Area (HLA) on all passen- 
ger ships. The Formal Safety Assessment that was prepared by DNV, for Norway 
and ICCL, showed that this requirement could not be justified as the cost were in 
great disproportion to the benefits for non-Ro/Ro passenger ships. The cost of avert- 
ing a fatality was about $37 million. A decision was therefore made to repeal the 
requirement (see also Sect. 4.3 of this chapter). 

Society spends large sums (up to 20% of Gross Domestic Product (GDP?) in 
some countries) on safety. Such use of resources cannot easily be justified in order 
to optimise economic production or the well-being in the population. Resources are 
limited and society in practice put some limit to how much resources could be used 
for safety, and thus a cost effectiveness criterion may be applied. 

The evaluation of fatality risks is a critical step in this process, and modern risk 
assessment practice is to highlight this issue by expressing the results in the form 
of a Gross Cost of Averting a Fatality (GCAF) if a risk control option were to be 
adopted, i.e. by cost effectiveness assessment. 


Table 3.5 Cost of averting fatalities in actual decisions 


Decision Decision maker Value($ million) 

Strengthening bulkheads on IACS and IMO (1) Ee) 
existing bulk carriers 

Helicopter landing area on IMO(2) < 37 (12-73,000) 
non-Ro/Ro passenger ships 

3 bulkheads on car deck IMO(3) <5 

3 bulkheads on car deck NMD(3) 3 

3 bulkheads + sponsons IMO(3) <7.8 

Extended sponsons only IMO(3) <li 

Collision avoidance training Owner(3) > 0.7 

Extra deck officer IMO(3) KID 


Re: (1) Mathiesen (1997), (2) Skjong et al. (1997), (3) DNV (1997b). 


° GDP = An estimate of the total money value of all the final goods and services produced in a 
given one-year period using the factor of production located within a particular country’s borders. 
The differences between GDP and GNP arise from the facts that there may be foreign-owned 
companies engaged in production within the country’s borders and there may be companies owned 
by the country’s residents that are engaged in production in some other country but provide income 
to residents. 
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ACost 


ee ee 


(3.7) 


ACost is the marginal (additional) cost of the risk control option, whilst ARisk is 
the reduced risk in terms of fatalities averted. 

An alternative cost-effectiveness measure is given by Net Cost of Averting a Fa- 
tality (NCAF), where the economic benefits of the investigated risk control options 
are accounted for. Economic benefits (or risk reduction) may also include the eco- 
nomic value of reduced pollution. The consequence of pollution may be established 
from clean-up costs and environmental costs or from previous decisions, see below 


ACost — AEconomicBenefis AEconomicBenefis 
NCAF = ARisk = GCAF ARisk (3.8) 


This approach then requires criteria to define the NCAF values at which measures 
are considered just cost-effective. Again, there are many methods to identify an 
evaluation criterion. Alternatives are such methods as willingness to pay studies 
by public surveys, willingness to pay in actual decisions, studies of risk control 
options implemented and not implemented. If regulators could avoid implementing 
risk control options with high NCAFs and implement those with low NCAFs, more 
lives would be saved for the same budget (Condition of Pareto optimality), see e.g. 
Tengs et al. (1995) and Ramberg and Sj@berg (1997). 

Table 3.6 gives values of CAF used by some authorities. 

Large studies in other industries have revealed large inconsistencies in safety 
policy. The most well known and largest study is that of Tengs et al. (1995) carried 
out in the US. Table 3.7 presents the average values from this study. These figures 
represent willingness to pay in actual decisions. Assuming that a fatality correspond 
to 35 lost life-years, the median value corresponds to $1.470.000. 


Table 3.6 Published CAFs in use as evaluation criteria 


Organisation Subject CAF Source 

US Federal Highway Road transport $ 2.5 million FHWA (1994) 
Administration 

UK Department of Road transport £1.0m (1998, DETR (1998) 
Transport up-rated with 

GDP per capita) 

UK Health & Safety Industrial safety As above or higher HSE (1999) 
Executive 

Railtrack (UK rail Over-ground As above to £2.65m Railtrack (1998) 
infrastructure railways 
controller) 

London Underground £2million Rose (1994) 
Underground Ltd railways 

EU Road transport €1 million Evans (1998) 


Norway All hazards NOK 10m Norway (1996) 
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Table 3.7 Results from Tengs et al. (1995) 


Five hundred life-saving interventions and their cost effectiveness 


Number of measures studied 587 

Range of cost effectiveness Negative to $10 billion/life year saved 
Median value $42.000/life year 

Median for medical interventions $19.000/life year 

Median for injury prevention $48.000/life year 

Median for toxic control $2.8 million/life year 


It is also possible to derive evaluation criteria expressed as NCAF from com- 
pound aggregated social indicators, see UNDP (1990) and Lind (1996). The Life 
Quality Index Criterion for acceptable risk implies that an option is preferred or 
accepted as long as the change in the Life Quality Index owing to the implemen- 
tation of the option is positive. The Life Quality Index contains such indicators 
as GDP/capita and life expectancy at birth. As a risk control option changes these 
two values, an optimum acceptable NCAF may be derived, and as GDP and life 
expectancy varies between countries there are variations in the evaluation criteria. 
Within OECD member countries (representing some 95% of the global GDP and 
presumably a similar share of the maritime transport), the variation is not very large, 
see Fig. 3.9. 

Based on the above Fig. 3.9, a NCAF criterion of $3 million was proposed for use 
by IMO, in cases where fatalities in addition to representing fatality risk also repre- 
sent an indicator of risk of injuries and ill health. The NCAF criterion is proposed to 
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Fig. 3.9 The net cost of averting fatality criteria for OECD member countries. The blue (left) 
columns would be defendable by purely economic considerations (production value of man), the 
red (middle) columns represent the societal value (derived from the societal indicators), the yel- 
low (right) columns represent the limit where no regulation should be implemented as individuals 
would use the resources better on life saving. The OECD average numbers are 0.76, 2.65 and 
US$8.93 million (Skjong and Ronold 2002) 
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Fig. 3.10 The cost of averting fatality (CAF) criteria for OECD member countries. The OECD 
average numbers for 2007 are 1.57, 7.23 and $17.2 million. From 2001 to 2007 the recommended 
criteria is up from 2.65 to $7.23 million. Most of the effect is due to the decreased value of the 
US$, but there is also an effect of economic growth and reduced hours of work 


be updated every year according to the average risk free rate of return (some 5%), or 
if data are available by use of the formula derived on the basis of societal indicators, 
see Skjong and Ronold (1998). Higher values may be justified for risks that are just 
tolerable, and a range of $2-5 million may be indicated. 

By using the same procedure as above, but input data from 2007, Fig. 3.9, should 
be replaced by Fig. 3.10. Data are collected CIA fact book, the International Mone- 
tary Fund (IMF) and the World Bank (WB), all referenced from e.g. Wikipedia. In 
developing the updated numbers, the actual value for w (the part of time in economic 
production) has been estimated based on real statistics for 2007 for each country, 
rather than a common value of w = 1/8, as used in Skjong and Eknes (2002), a 
number estimated by Natwani et al. (1997). 


3.12.7 Risk of Injuries and Ill Health 


As indicated above risk of injuries and ill health may be dealt with implicitly or 
explicitly in the FSA. In the societal indicator approach the indicator is life-year 
(life expectancy at birth), and may be interpreted as an indicator of life expectancy 
as well as life quality. The NCAF criterion may therefore implicitly be assumed to 
account for risk of injuries and ill health. In separate studies of risk of injuries and 
ill health, the NCAF criterion is therefore initially of no use. It may, therefore, be 
suggested to use the NCAF criterion and split it into contributions covering risk of 
death, injuries and ill health separately. 
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According to the UK Department of Transport, (DETR 1998), the willingness to 
pay for slight injuries is 0.9% of the value of prevention of a statistical fatality. The 
number of injuries to crew on UK registered merchant vessels during 1993-1997 
was 1886 compared to 15 fatalities (MAIB. 1998). The ratio of approximately 130 
injuries to | fatality can be applied to the estimated personal accident rate above. 
The severity of these injuries is not defined, but they are assumed to be equiva- 
lent to lost-time injuries, as they do not necessarily involve medical evacuation. It 
is not clear how comprehensively they are reported. This suggests that the overall 
cost of injuries could be approximately equal to the loss value of fatalities (0.9% of 
130 = 1.17). Similar results have previously been reported in UK (1997). By defin- 
ing serious injuries as 1/10 equivalent fatalities, and minor injuries as 1/100 equiv- 
alent fatality the data suggested a 1:1 correspondence (or actually 14:14.89). These 
results are highly uncertain, and for comparison, fatalities on Norwegian roads are 
estimated to contribute with approximately 14% of the total costs of fatalities and 
injuries, whereas the injuries are estimated to contribute the remaining 86% (Elvik 
1993). The relatively large difference between these estimates may be explained by 
minor injuries in traffic on average being more severe than minor injuries for crew 
members. It is thus initially, in the lack of better statistics, proposed to split the 
NCAF criterion equally between the two contributors, one applying for fatalities 
and one for risk of injuries and ill health. As more knowledge is gained, this should 
be revised. 

A criterion based on the Disability Adjusted Life Years (DALYs) gained may be 
used for risk control options affecting injury and health. This would be similar to the 
equivalent fatality approach suggested in UK (1997). An evaluation criterion may 
be established based on the NCAF criterion, see below. 

Attempts to measure and value quality of life are a more recent innovation, with 
a number of approaches being used. The DALY is advocated as a measure for health 
effects by the World Health Organisation (WHO 2000). Particular efforts have been 
invested in researching ways in which an overall health index might be constructed 
to locate a specific health state on a continuum between 0 (= death) and 1 (= per- 
fect health). Obviously the portrayal of health like this is far from ideal, since, for 
example, the definition of perfect health is subjective and some individuals have ar- 
gued that some health states are worse than death. In any case it seems better for the 
regulator of maritime safety to use concepts developed by specialized organisations 
like WHO. 

The DALYs are presently crude numerals, but may be sufficient in prioritising 
risk control options, which is their use in a risk assessment. It is necessary to be 
aware of their limitations, and more research may make the process better docu- 
mented, justified and useful. 

DALYs may provide an indication of the benefits gained from a variety of RCOs 
in terms of quality of life and survival. An example is shown in the Fig. 3.11. The 
RCO could be e.g. the use of protective shoes. The benefit of the RCO is illustrated 
in the Figure in terms of DALYs gained by one person. 

Some sources of information on DALY and similar indicators may be 
referenced. 
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Fig. 3.11 Example of disability adjusted life years gained by one person by implementing a risk 
control option 


The Quality of Well Being Scale (Kaplan and Anderson 1988) 

The McMaster Health Classification System (Drummond et al. 1987) 
The Rosser and Kind Index (Kind et al. 1982) 

The EuroQol Instrument (EuroQol Group 1990; Nord 1991) 

The World Health Organization 


If it is assumed that on average one prevented fatality implies 35 Disability Ad- 
justed Life Years gained, a DALY criterion may be based on the NCAF criterion as 
follows: 


NCAF criterion /2 _ $3 million/2 


DALY criterion = Ke 35 


= $42,000 per DALY gained 


This figure is very close to the figure used for decisions in the health care area, 
where e.g. Gafni (1999) refer to a DALY of $35,000. The average value for life 
saving interventions in the US in Tengs et al. (1995) is also $42.000 per life-year, see 
Table 3.7. It is actually surprising how such criteria derived by different techniques 
produce the same or very similar results. 

If it is accepted that the ship type analysed is already in the ALARP area, only 
the cost effectiveness criteria apply. This simplifies considerably and FSA reduces 
to a Pareto optimisation, a method that may easily be implemented as a method for 
risk based design, and that fits nicely into a concurrent engineering approach. 


3.13 Environmental Risk Evaluation Criteria 


In addition to fulfilling requirements on individual and societal risk to people, ac- 
tivities that introduce additional risks to the environment need to meet acceptance 
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criteria for environmental risk as well. Damage to the environment can be expressed 
at different levels such as organism level, population level, habitat level complete 
ecosystem level, or global level (as for CO2) and several environmental compo- 
nents can be damaged. Environmental risk assessment is about making estimates of 
harm to plant and animal life and to the ecosystem integrity that can later be com- 
pared to previously agreed risk acceptance criteria. However, due to practicality, 
environmental risk analysis for a complete ecosystem is normally not performed, in 
particular not to decide on an RCO to be implemented on a ship, which in general 
is allowed to trade globally. The risk is rather assessed for vulnerable single compo- 
nents within the environment, e.g. stock of specific species or habitats. These serve 
as risk indicators and this is normally considered to be sufficient in order to estimate 
the environmental risk. 

In a report published by GESAMP in 2001 it was made clear that the major 
threats to the marine environment came from activities on land. In comparison, 
the environmental pressure on the oceans due to shipping was believed to have de- 
creased over the past decade. Nevertheless, the environmental risk stemming from 
shipping activities should not be trivialized, and the following sections of this chap- 
ter will discuss issues related to environmental risk and shipping. 

Environmental impacts from shipping activities may be caused by regular (both 
legal and illegal) and accidental releases. The regular releases (of e.g. CO2, NOx, 
sewage or garbage) are not considered here in a risk context, as the estimation of 
quantities of regular releases may be done without involving the use of risk assess- 
ment, and the estimation of consequence is no different from releases from other 
sources. Risk assessment for regular releases is only relevant if the system is not 
defined as the ship, and the analysis go into analysing short and long term effects 
on the environment, habitat, biodiversity etc. For accidental releases, however, risk 
assessment is as relevant as for accidents threatening safety of crew and passen- 
ger. Figure 3.12 illustrates the most important emissions and discharges from tanker 
ships in operation. 

At IMO there has so far not been any application of FSA for environmental con- 
sequences. Therefore there has not been any detailed discussion on environmental 
risk criteria based on real analysis. 

Early on there were some debate in the Joint MSC MEPC working group on 
FSA on environmental risk criteria and it seems that the tendency has been to favour 
the use of some cost effectiveness criteria for the risk control options that are con- 
sidered. For oil-spills this would imply that the criterion would be for example a 
$/tonnes of accidental release of oil (and other pollutants) prevented. Information 
could be the cleanup and compensation costs from spills in the past, or it could be 
based on willingness to pay studies. Both methods were suggested in Mathiesen and 
Skjong (1996). 

An example of willingness to pay for preventive measures may be identified by 
studying the cost and benefits of OPA 90 and other risk control options that have 
been implemented in the past. For OPA 90 this has been done by US Coastguard, 
(Speares 1991). The total costs has been estimated to $11 billion and the reduction 
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Fig. 3.12 Emissions and discharges from ships in service (tankers) 


of accidental release was estimated to 1.2 million barrels, 9,167 $/barrel or about 
57,660 $/tonnes. 

Based on a review of cleanup costs, estimates of environmental damages, and ap- 
plying an insurance factors of 1.5 (reflecting the willingness to pay more for preven- 
tion than paying for the cleanup and living with the environmental consequences), 
Skjong et al. (2005) proposed a Cost of Averting a Tonne of oil Spill (CATS) of 
$60.000. 

Of this the average cost of cleanup is $16.000, the average environmental costs 
is $24.000 based on review of available literature. The sum is thus $40.000. With an 
insurance factor of 1.5 (from insurance statistics), this results in a CATS of $60.000. 
This is close to the willingness to pay in line with OPA90. 

The debate on which criteria to use has not come yet to a conclusion. However, 
there are already a number of FSAs that have used the suggested CATS value. The 
debate seems now to go in two different directions, complicating the use of one 
single CATS number to multiple values, namely: 


e Dependent on spill size 
e Dependent on accident type (grounding, collision etc.) 
e A combination 


At time of writing this section, it is not clear what will be the end result. 

Societal risk acceptance of environmental damages from shipping is not yet pro- 
posed. And, to effectively apply a cost-effectiveness criterion related to environmen- 
tal protection, societal risk acceptance and the associated ALARP area need to be 
defined. Risk evaluation criteria related to the protection of the environment are not 
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yet agreed at IMO. Thus, no proposal concerning the acceptability of the societal 
risk of environmental damages from oil transport by tankers exists. 

McGregor (2007) suggested an ALARP region for oil spills of tankers based on 
information from US pipeline requirements. He presented an ALARP area using 
historical data relating to oil spills of AFRAMAX tankers. His assessment is based 
on a consequence function which is linearly dependent on oil spill size, thus, view- 
ing large spills as relatively less important. This is based on the recommendation 
from the US Marine Board (2001) which indicated that the relationship between 
spill size and environmental consequence is nonlinear. Introducing the relationship 
of consequences and oil spill size (C = 1 equals 1892 m? of oil), McGregor pre- 
sented his proposal using oil outflow as parameter and the newly proposed criterion 
has a much gentler slope than the usual slope of -1. This reflects the opinion that 
large spills are relatively less severe than smaller spills. 

Sames and Hamann (2008) explored how an ALARP area could be fitted to 
existing oil-spill data under the assumption that current maritime oil transport by 
tankers — defined by 1990-2006 data — is JUST acceptable and cost-effective risk 
control options should be implemented. By fitting the ALARP boundaries to larger 
spills, spills smaller than 20 tonnes are considered negligible, i.e., no design or rule 
changes should be targeting these spills. The second approach considered ratio of 
CAF and CATS is used to translate the ALARP boundaries for oil tankers from 
the FN-diagram. The resulting ALARP boundaries render maritime oil transport ef- 
fectively unacceptable as spills larger than 1000 tonnes are in the intolerable area. 
Only by introducing a spill-size dependent value of CATS, this second approach was 
shown to deliver a meaningful result. They concluded that that the presently avail- 
able historic data are not sufficient to evaluate the environmental risk of oil tankers 
or to demonstrate the appropriateness of the proposed ALARP area. 


3.14 Environmental Risk Criteria — CO, 


The same approach may be used to prioritising reduction in emissions. Actually, 
most of the high level analysis that is needed was carried out by Intergovernmental 
Panel on Climate Change (IPCC), and is reported in the Fourth Assessment Re- 
port form, Contributions from Working Group II. The report contains estimates 
of the risk reduction at different carbon price levels, both based on top-down and 
bottom-up studies and for two different scenarios. This is given in IPCC (2007), 
Table SPM.1 and 2. Reproduced here as Tables 3.8 and 3.9. 

The economic potential for emission reduction estimates is surprisingly consis- 
tent at all carbon price levels. The two scenarios are defined as follows: 

The A1 storyline and scenario family describes a future world of very rapid eco- 
nomic growth, global population that peaks in mid-century and declines thereafter, 
and the rapid introduction of new and more efficient technologies. Major underlying 
themes are convergence among regions, capacity building and increased cultural and 
social interactions, with a substantial reduction in regional differences in per capita 
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Table 3.8 Global economic mitigation potential in 2030 estimated from bottom-up studies 


Carbon price Economic Reduction relative to Reduction relative to 

(US$/tCO2-eq) potential SPES A1B SPES B2 
(GtCO2-eq/yr) (68 GtCO2-eq/yr) (%) (49 GtCO2-eq/yr) (%) 

0 5-7 7-10 10-14 

20 9-17 14-25 19-35 

50 13-26 20-38 27-52 

100 16-31 23-46 32-63 


Table 3.9 Global economic mitigation potential in 2030 estimated from top-down studies 


Carbon price Economic Reduction relative to Reduction relative to 

(US$/tCO2-eq) potential SPES Al B SPES B2 
(GtCO2-eq/yr) (68 GtCO2-eq/yr) (%) (49 GtCO2-eq/yr) (%) 

20 9-18 13-27 18-37 

50 14-23 21-34 29-47 

100 17-26 24-38 35-53 


income. The Al scenario family develops into three groups that describe alternative 
directions of technological change in the energy system. The three Al groups are 
distinguished by their technological emphasis: fossil intensive (A1FD, non-fossil 
energy sources (AIT), or a balance across all sources (A1B) (where balanced is de- 
fined as not relying too heavily on one particular energy source, on the assumption 
that similar improvement rates apply to all energy supply and end use technologies). 

The B2 storyline and scenario family describes a world in which the emphasis is 
on local solutions to economic, social and environmental sustainability. It is a world 
with continuously increasing global population, at a rate lower than A2, intermedi- 
ate levels of economic development, and less rapid and more diverse technological 
change than in the B1 and A1 storylines. While the scenario is also oriented towards 
environmental protection and social equity, it focuses on local and regional levels. 

Assuming that the politically expressed wish to reduce the emission by 80%, 
compared to the current level B2 scenario at 2030, and ignoring the uncertainties, 
this indicates that all measures that can avert a tonne of CO2—-eq emission for $50 
should be implemented now or in the near future. This is higher but not that far from 
the current price of about €25/tonne in the EU market, considering that all economic 
models predict an increased price. At IMO this way of deciding to implement RCOs 
would be consistent with current decision making processes and FSA, e.g. 


Cost of Averting a Tonne CO, — eq Heating effect (CATCH) = $50 


It may obviously also be argued that due to the uncertainty in the estimates, 
and the long term irreversible effect of climate change, a safety factor should be 
introduced too. For a discussion on this topic, see Nordhaus (2008). 
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3.15 Risk Criteria for Use in Risk Based Design 


Risk Based Design has always been an option, in the sense that all regulations con- 
tain possibilities for proving safety equivalency. It may actually be against both 
WTO and EU regulations (on free trade), to develop regulations that do not allow 
for equivalent solutions. Viewed from a free trade’s standpoint, it is frequently ob- 
served that safety and environmental regulations are used to distort competition. 
However, in shipping, no court case is known where trade treaties are used to chal- 
lenge safety/environmental protection regulations. 

In the project SAFEDOR the long term objective is to develop a risk based regu- 
latory regime, and it is clear from the work program that this has a dual purpose: The 
Rules and Regulations should be risk based, but the ultimate goal is also to develop 
the necessary methods, tools and understanding to allow for risk based design — or 
direct use of risk analysis techniques in designing and approving innovative ship 
designs. Actually, when FSA was first proposed, it was presented as a Safety Case 
Regime for ships. This was soon realised to be unrealistic as a general approach to 
maritime regulations. 

In the following an attempt is made to define clearly what is meant by a risk 
based regulatory regime — this is done by defining a long term goal, disregarding a 
number of practical and implementation problems. 

A risk based regulatory regime implies that regulations have been developed and 
justified based on well defined approaches to reduce risk in the most cost effective 
manner until further risk reduction involves excessive costs. A risk based regulatory 
regime is also open to direct use of risk assessment in design and design approval, 
thereby being open for innovation in cases where the prescriptive regulations are 
prepared with applicability to specific technologies. A risk based regulatory regime, 
is characterized by rationality, objectivity, transparency, auditability, openness for 
innovation, etc. The aim of a risk based regulatory regime is also to optimise invest- 
ments in safety and environmental protection. 

In this chapter the term regulatory regime is limited to regulations related to 
safety and environmental protection, and also limited to shipping activities. There 
are other uses of the term risk based regulatory regimes, both outside shipping and 
not related to safety and environmental protection. 

Risk based implies that regulations are justified by risk analysis (FSA), usually 
by referring to agreed risk acceptance criteria. In the maritime sector, ‘risk based’ 
rules and regulations therefore usually refer to adherence the FSA process in the 
development and justifications for rules and regulations. Whilst the risk analysis es- 
timates probabilities and consequences of accident scenarios, the regulations them- 
selves may be simple requirements, which are prescriptive and do not refer to risk 
(Tier IV in the GBS Structure). There is therefore no contradiction in referring to a 
rule or regulation as risk based and prescriptive. The risk analysis has the status of a 
commentary (GBS terminology), justifying the regulations and thereby explaining 
the reasons the regulation is in place. This analysis is therefore auditable, and may 
be subjected to review. 
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The risk based regime is rational in many meanings of the term. For example, 
the analysis is based on reason and logic, by explicitly using logical diagrams like 
fault and event trees and other scientific tools. The risk model may however, as all 
models also be based on simplifications and assumptions that should be verified. 

A risk based regime is objective in its dealing with facts or conditions as ob- 
served and analysed, without distortion by personal feelings, prejudices, or inter- 
pretations. There may be subjectivity involved in the analysis, stemming from use 
of experts (Skjong and Wentworth 2001), for example to estimate probabilities or 
consequences, or risk reducing effects. Subjectivity should in such cases be reduced 
as far as possible by using appropriate expert elicitation techniques. 

There may also be discussions on the objectivity of risk criteria. For example, 
the justification for the amount of money invested to reduce the risk to human life is 
today considered objective by many, and the literature based on rational approaches 
are growing very fast, whilst others claim such decision parameters are based on 
subjectivity and should be based on political decisions. This being the situation, it is 
important that such issues are agreed in open and transparent deliberative processes. 

The risk based rules and regulations should represent an optimum solution to the 
regulatory issues, in the sense that the marginal return of investing in further safety 
and environmental protection should not be achievable without violating the accep- 
tance criteria. I.e. increased investments in one risk control option compensated by 
reduced investments (of the same size) in another risk control option would result in 
reduces safety and/or environmental protection. This is usually referred to as Pareto 
optimality. 

In the description of the risk based regulatory regime within the maritime sector, 
reference is made to the IMO Guidelines for Formal Safety Assessment. If all reg- 
ulations with impact on safety and environmental protection had been justified by 
FSA studies, that had also been subjected to review, and that was based on agreed 
risk criteria, the resulting rules and regulation would been termed risk based. A reg- 
ulatory system based on FSAs will inevitably become goal based, because the safety 
goals will be stated in terms of the risk evaluation criteria. 

Use of FSA also disclose implicit safety levels in current regulations and disclose 
the cost effectiveness of risk control options required by existing regulations as well 
as in new and proposed regulations, contributing to transparency. 

There have already for a long time been developments at IMO in the direction of 
risk and goal based regulations. For example, the new damage stability regulations 
have defined a probabilistic design procedure, estimating the conditional probability 
of surviving a collision with water ingress: A; where the requirement is defined as 
a minimum probability level: R. The design is accepted if A > R. This regulation 
is clearly both risk based (probabilistic) and goal based. However, the required sur- 
vivability was, at the time of that regulation’s development, not based on the risk 
acceptance criteria, but rather on a harmonisation of existing requirements. 

In SOLAS Chapter II-2 Regulation 17, there are provisions for basing the fire risk 
assessment on a formalised risk based analysis. The goal is that new designs should 
be as safe as or safer than what is required by the current prescriptive regulations. 
Each time such a design analysis is carried out, the implicit safety in the current 
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prescriptive regulations will be disclosed. This regulation is therefore also risk 
based, although IMO has not formulated a goal based standard, e.g. by specifying 
the acceptable risk level. The individual functional requirements are also formulated 
in each regulation, each of which can be linked to a fault tree (fire safety concept 
tree). This demonstrates that FSA may be used also to structure a risk based and 
goal based regulation. 


3.16 Risk-Based Approaches in the Context 
of the Regulatory Regime 


Throughout the history of maritime regulation ship owners, designers and builders 
have had to adhere to prescriptive rules; rules stating which configurations, instal- 
lations and dimensions a ship must have. It has always been possible, in cases of 
innovative design solutions, to approve the design based on some sort of risk anal- 
ysis and equivalency with the prescriptive design. This, of course, provided that the 
innovative design is safer than or as safe as the prescriptive design. This approach 
is resulting from SOLAS Part A, Regulation 5: ‘Equivalents’. Though this route to 
approval is possible, it is unpredictable and may involve high (economic) risk for 
the owner in a new-building project. The main reason for this is a lack of agreed 
standards for accepting equivalent solutions — the approval process is unpredictable. 

A step forward with respect to such standards is regulation 17 of SOLAS Chap- 
ter 2-II, which follows standard risk assessment procedures closely. Regulation 17 
describes functional requirements to be met concerning fire safety, and prescriptive 
regulations for standard designs. The envisioned future risk based regulatory frame- 
work will in a similar (but improved) manner describe all aspects of a ships design. 

In the process of approving an innovative design solution the aim is to quan- 
tify the risk through what is generally called a quantitative risk assessment method 
(QRA). However, knowing the risk level is not of much value without a reference 
value that can be referred to in the approval process. With the exception of the risk 
acceptance criteria at ship level as described above, currently, the only reference 
value is the risk level associated with the prescriptive design solution, which all in- 
novative solutions will have to be compared to. This means that both the innovative 
and the prescriptive designs will undergo a QRA, and the two risk levels will be 
compared. One weakness inherent in this approach is that the current prescriptive 
rules may be the product of an opaque and unknown process and the priorities of 
the recourses (the allocation RCOs) may be far from optimum, and the associated 
risk levels have not been scrutinised and may be far from optimal. The comparison 
with such a risk level may therefore not be desirable. 

Within a risk based regulatory regime the objective is to provide knowledge of 
risk levels that are acceptable and with which comparison is desirable and practica- 
ble, ensuring that innovative designs undergoing a QRA may be measured against 
agreed sensible criteria. Within the risk based framework a tiered system of safety 
goals/requirements/objectives is developed where the low level goals are consistent 
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Fig. 3.13 Emissions Relationship between risk-based, performance based and prescriptive design 
criteria (Skjong et al. 2005) 


with the high level goals. The envisioned relationship between risk based, perfor- 
mance based and prescriptive goals is illustrated in Fig. 3.13. 

Such a risk based and goal based approach may be applied at any level from the 
overall ship safety level downwards. This makes it possible for a designer to evaluate 
the innovative solution against the most practicable level of goals, minimizing the 
work required and streamlining the approval process. The goals will be explicit, 
and the process of demonstrating compliance will be described in detail, providing 
a process for approval of innovative designs which is transparent, predictable and 
rational. Figure 3.13 illustrates this point. 

The ideal situation for the designer is, in principle, represented by the new dam- 
age stability regulations (IMO 2005). These regulations require the calculation of 
the attained index A, which value must be higher than the required index R; such 
that A > R. Here A is a conditional probability of the ship sinking following a col- 
lision with water ingress. Both A and R are therefore probabilities that can easily 
be associated with a risk model of the collision scenario. The drawback with the 
approach used to derive R was that this was done based on harmonisation In the 
FSAs on Cruise and RoPax an attempt is made to derive a new R requirement based 
on the FSA approach and the IMO risk evaluation criteria. This results in a stricter 
requirement for R (Denmark 2008b, 2008c). 

The envisioned future regulatory regime will facilitate the approval of innovative 
ship designs which deviate from prescriptive rules. The approval of such designs 
must be predictable, transparent and consistent. The amount of work involved in 
obtaining such an approval should be kept at a minimum to ensure an effective 
process. The approval of innovative designs will depend on the design’s safety level. 
To ensure efficiency the verification of safety should be done according to current 
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rules and regulations as far as possible. Only those elements that are affected by 
the innovative element should be subjected to risk based approval, and at the lowest 
possible level, where the top level is overall ship safety, and the bottom level is 
system component level (nuts and bolts). Figure 3.13 illustrates this. 


3.17 General Procedure for Establishing Risk 
Criteria at Lower Level 


Skjong et al. (2005) describes various possible procedures for developing risk ac- 
ceptance criteria at ship function (or lower) levels, and also includes some exam- 
ples of how this procedure works. Two worked examples are publicly available. 
One relates to hull girder strength, IACS (2006), and the other to systems, Rude 
and Hamann (2008). However, the only new element as compared to the litera- 
ture on use of Structural Reliability Analysis for ship safety is the use of the FSA 
risk acceptance criteria in SRA. As a general procedure this may be described as 
follows: 


Step 1: Develop a risk model, including all scenarios that are affected by the 
function in question. 

Step 2: Use the decision criteria relating to cost effectiveness described above, 
for the function 

Step 3: Derive the target reliability (or availability) by cost effectiveness criteria 

Step 4: Use this ‘optimum’ as reliability (availability) as target for the function 
analysed. 


It is seen that in Step 3, there is an implicit assumption that the risk is in the 
ALARP area, and that cost effectiveness criteria can be applied. It is also seen that 
this procedure is a simplified FSA, limited to the relevant function. 

When risk based acceptance criteria are derived from previous FSA studies this 
procedure is followed, because an FSA study should, in principle, include all rele- 
vant functions and scenarios. 

It should be noted that the risk acceptance criteria derived this way for the pur- 
pose of regulation, may not be dimensioning for the function in question, as e.g. 
purely commercial considerations may result in more strict requirements. If this is 
the case, and can be proven to be the case under a variety of conditions, the regulator 
may decide not to regulate. 
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Chapter 4 
Risk-Based Approval 


Jeppe Skovbakke Juhl 


Abstract Due to an increase in the number of novel and risk-based ship designs 
over the past years, there is a growing need within the maritime industry for a for- 
mal approval process allowing for innovation. The scope of this chapter is to give 
an overview of the expected levels and requirements related to the approval of the 
risk-based designed ship e.g. to the required documentation, as they are assessed 
from the current standpoint of development; it is expected that this will establish in 
due time the necessary confidence in risk based approaches and their fundamental 
role in ensuring safety. A matrix with explanatory comments has been developed to 
facilitate the development of guidance to the client as well as for the approval au- 
thority with regard to the depth of analysis and examination requirements affecting 
the various levels in the approval process. 


4.1 Introduction 


Risk-based ship design and approval is envisioned to satisfy the maritime indus- 
tries’ need to deliver ever more innovative transport solutions to their customers. 
Risk-based ship design and approval will — at the same time — motivate, but also sat- 
isfy the society’s need to have increasingly safer transport. The motivation is thus 
twofold; to improve the competitiveness of those organisations, which drive inno- 
vation and are able to exploit the new opportunities as well as to increase safety by 
increasing the knowledge and understanding of risk issues relating to ship design 
and operation. 

Risk-based approaches in the shipping industry started with the concept of 
probabilistic damage stability in the early 1960s, and risk-based design was later 
widely applied within the offshore sector and is now being adapted, extended and 
increasingly utilised within the shipping sector. Risk-based ship design introduces 
risk analysis into the traditional design process aiming to meet safety objectives 
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cost effectively. This is facilitated by use of advanced computational tools to quan- 
tify the risk level of particular candidate designs. Risk is used to measure the 
safety performance. With safety becoming measurable, the design optimisation can 
effectively be expanded and a new objective — to minimise risk — is addressed along- 
side commercial design objectives relating to earning potential, speed and cargo car- 
rying capacity. It is expected that with the introduction of safety as an objective into 
the design optimisation process, rather than treating it as a constraint, new technical 
solutions can be explored: the design solution space becomes larger. 

The number of novel and risk-based designs appears to be increasing. There may 
be a number of reasons for this, but the most important ones are: 


Economic motivation for new designs, 

Needs for new or modified designs to fulfill new operational requirements, 
Recent regulatory developments opening up for more risk-based designs (e.g. 
SOLAS-IL.2/17). 


Today the development in all industries, including the maritime, is subject to 
rapid and often radical technological changes. These changes now take place more 
frequently at ever shorter time intervals. Changes and eventually actual breakthrough 
solutions appear at a much faster pace than our experience is gained. Therefore, the 
established method of basing any development on empirical data at best displays 
severe limitation. For advanced and sophisticated ships the traditional method is by 
no means adequate. 

The present regulatory system is, confronted with a novel risk-based design, of- 
ten inadequately suited to a ship owner’s motivation for exploiting the full market 
potential. This is mainly due to the fact that new developments concerning rules and 
requirements will frequently not be in place when these ship owner needs appears. 

The existing regulatory system for the maritime industry consists primarily of 
international regulations developed by the IMO and enforced by the Flag States. 
In addition the classification societies have developed their own rules covering the 
safety of hull, machinery and electrical systems. Furthermore there are regional 
rules, national rules and even rules for specific ports. These rules are the result of a 
continuous amendment process. 

The existing regulatory system is of a very complex nature and the initiating 
event for any given development is rarely easily identified. At times a development 
may address safety deficiencies — developed as a result of a specific accident. In that 
respect the regulation reveals itself to be re-active rather than pro-active — in other 
words: the regulation focuses on avoiding similar situations to arise as opposed to 
pro-active accident prevention. 

Throughout maritime history, a major motivating factor in devising new regula- 
tion has been based on analysis of marine incidents of the past, enforcing regulations 
aiming at preventing identical or similar incidents and accidents to occur again. 

Legislating in this manner has advantages. Arguing the necessity of any new 
measure largely consists of acknowledging a failure of equipment, design, manage- 
ment system etc. which may have lead to a marine accident or incident, a consensus 
is built on a desire for loss prevention in the future. Such prescriptive regulation is 
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“commercially safe”, in terms of providing a relatively high degree of assurance in 
any given design to be approved. It is simple to evaluate. 

It may, though, also constitute a limiting factor, as very few commercial operators 
will engage in challenging the current state of the art, if the perspectives of having 
anything novel approved are futile. 

Utilizing a novel piece of equipment and breaking the ground for new approaches 
may often appear as a win-all or lose-all deal to the operator, as insights gained 
from the (presumably cost intensive) research- and trial period may well come to 
the benefit of other less daring operators, waiting for others to make the mistakes 
for them. 

When developing requirements dealing with a new approval process to perform 
safety verification in an efficient and responsible manner, it should initially be rec- 
ognized, that existing prescriptive requirements are not necessarily as objective and 
“safe” as one could assume. This is not to say that any existing figures, numbers or 
measures have been chosen at random. As previously stated, they will usually be a 
reaction to one or more marine incidents. 

This, though, also bears within a potentially longer reaction time throughout the 
industry, when novel designs or systems are at hand which — at least at the time 
suggested — have no precedent historical record. Obstacles to innovative solutions 
which may potentially enhance maritime safety, though, can indisputably not be 
regarded as an advantage by any means. 

Also, one argument in favour of applying alternative approval methods is the 
widely neglected fact, that in principle, the sheer dimensioning of vessels as they 
are currently being constructed may cause prescriptive rules to fall short, to put it 
bluntly, in that particular respect, the future may already be here. 

As vessels are growing in size, as well as through general progress in research 
dealing with e.g. the environmental loads (such as freak waves etc.) which ocean 
going vessels may be subjected to, it becomes increasingly questionable whether 
the prevailing requirements for strength and stability are in fact even living up to the 
present situation and state of knowledge. 

Alternative approval methods for alternative designs and systems should serve as 
a motivating factor to venture into new and previously less explored fields, even to 
the less daring. 

Given the above considerations, this is not only beneficial in terms of constituting 
a competitive advantage, but may in fact be crucial to maintain a high level of safety 
while keeping abreast of future developments and discoveries. 


4.1.1 Why Do We Need an Approval Procedure Related 
to Risk-Based Design 


From a ship owner’s perspective there could be various elements which drive the 
motivation to introduce safety objectives explicitly in the design process: 
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First, it is the realisation of an idea for a new transport solution which challenges 
(possibly outdated) rules — meaning that the new solution cannot be approved. Risk- 
based design and approval are then used to identify the issues and prove that the new 
solution is at least as safe as required. A requirement from the Approval Authority 
can be either based on references to a specific vessel (equal level of safety) or by 
specified risk acceptance criteria. This approach is exemplified within the regulation 
17 of SOLAS-II.2 on fire safety, as explained later in this chapter. This first variant 
of risk-based ship design has become widely known as “safety equivalence.” It may 
also be called “rule-challenge” as existing rules and regulations are challenged. It is 
noted that when rule-challenging solutions are approved again and again, guidelines 
may be created to standardise the approach, and to make its application more cost- 
effective. 

Second, it is the optimisation of a rule-compliant vessel aiming to increase the 
level of safety at the same costs or to increase earning potential at the same level 
of safety. For this second variant of risk-based ship design application, the approval 
is only needed if the existing rules and regulations are challenged, but the design 
optimisation could well be within current rule and regulation limits. An example for 
this variant is optimisation within the new probabilistic damage stability regulations, 
SOLAS (2009). This second variant of risk-based ship design may be called “risk- 
based design optimisation” to differentiate this variant from the first. 

Both types of the risk-based design philosophy as mentioned above require the 
same technology and framework which reflects and derives from the introduction 
of safety as an objective in the design process as illustrated in the figure below. The 
design philosophy is divided into two horizontal levels: 


1. a design methodology needs to be developed, aligned with the traditional design 
process, which includes safety as objective and preferably integrate any associ- 
ated computational tools to quantify pertinent risks. 

the regulatory framework must be in place to facilitate the risk-based design — 
core elements of this are risk acceptance and evaluation criteria which preferably 
should be agreed at the International Maritime Organisation (IMO) (Fig. 4.1). 


Motivations 
example: example: 
SOLAS-II.2/17 prob. damage stability 


Enabling technologies 


Fig. 4.1 Motivation and enabling technologies for risk-based ships design and approval 
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From a historical perspective this process is not new to the maritime industry, 
even though the implementation has only been progressing slowly. 

A comprehension of the balance between safety of the ship and earning potential 
has for the last 5—10 years slowly started in modern passenger ferry designs. For 
example with regard to most of the existing North West European passenger Ro-Ro 
ferries fleet, which have been upgraded to meet enhanced damage stability require- 
ments by using design solutions achieved through a risk-based design optimisation 
process aimed to maximise cargo capacity and safety at minimum cost. 

Re-introduction of the atrium arcades on board cruise ships in the late Eighties 
paved the way for accepting novel design features beyond rule limits, and thus, 
performance-based design criteria provide the designer with increased freedom that 
can be exploited in the design and construction of new ships. As mentioned, the 
openings to alternative design in SOLAS have repeatedly been utilized in novel 
designs of passenger ships, such as the interior layout of public spaces and big atria 
that exceed the prescribed maximum size of a main fire zone (not greater than 48 m 
in length or 1,600 m* in area according to the prescriptive regulations). The specific 
need for rule development related to this issue resulted in the repeatedly quoted 
regulation 17. 

The freedom in design introduced by alternative regulations facilitates optimisa- 
tion of various design parameters, and a number of tools have been developed for 
corresponding design optimisation applications. 

One example, are the commercially available tools for analysing evacuation per- 
formance of passenger ships, that can be used to optimise the escape route layout 
and the evacuation arrangements. 

Broadening the design envelope, giving the owner a wider selection of possible 
design concepts enhances the motivation for innovation (Fig. 4.2). 


Acceptable 
risk level 
(rational) 


“Fit for purpose” (Business concept and functionality) 


Innovation 


potential The FSA on Cruise and 


RoPax demonstrates 
that the regulatory 
envelope is outside 

the rational acceptance 
envelope with regard 
to damage stability 


Regulatory 
envelope 


at 


O) 
Best solution 


Mostly unknown 
risk level 


Fig. 4.2. Design envelope (reference to Guarin et al. (2005)) 
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4.1.2 Present Approval Process — A Prescriptive Procedure 


Conventional ship design aims to satisfy requirements whilst achieving a balance 
between performance, costs and earnings. 

The ship owner has a main interest in ship performance, including elements such 
as payload, speed and safe operation; costs include building and operating costs; 
earnings include all items related to income potential; a requirement might include 
minimum environmental impact, class rule-based safety beyond regulatory compli- 
ance (voluntary notations) etc. But at the same time he must fulfill the regulatory 
safety regulations — but these are treated as post-design compliance issues. 

If both the ship owners and the regulatory criteria are fulfilled; the design is a 
viable candidate (Fig. 4.3). 

From the regulatory point of view, the presently established approval process 
proceeds along the lines of verifying compliance with international, regional and 
national regulation together with rules from the Classification societies (Fig. 4.4). 

As the regulatory regime at present is by and large prescriptive (with few exemp- 
tions), proof of compliance is hence achieved by means of accounting for, measuring 
and comparing the presented design with the applicable set of requirements, rules 
and standards. 

Should any particular feature deviate from the prescribed, the Approval Authority 
(normally the Flag Administration and/or a Classification Society) will be requested 
to consider the equivalence of the feature compared to the prescribed feature. 

Considerations on equivalence have up to this time mainly taken place on subsys- 
tems (including human element issues, such as safe manning), subsidiary features 
(such as emergency exits) or specific types of equipment (such as alternative LSA) — 
however rarely on a full scale ship project. 
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Fig. 4.3. Approval flow diagram for the “conventional” design 
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Fig. 4.4 Present approval Proven design 
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Verification of compliance rests with the Flag Administration, however elements 
of the work is delegated to the classification society as recognised organisation or 
nominated body. Subjects like working environment issues, stability requirements 
on passenger vessels, fire protection subjects etc. are verified by the Flag State Au- 
ditors and not by the recognised organisation. 

Decision making on equivalence also rests with the Administration. Accepting 
the equivalent feature is usually based on safety equivalence and is in many cases 
evaluated qualitatively, or through consequence assessment, mainly due to the rela- 
tively minor volume and scale of cases where equivalence is sought documented. 

In principle, considerations on equivalence will usually move along the lines of 
evaluating the inherent impact in risk reduction (or aggravation) based on qualita- 
tive evaluation by competent parties, supported by statistics, analysis, drawings and 
reviews. 

Applications will be evaluated by individuals having operational knowledge of 
the issue in question as well as by experts on the topic, and any decisions should 
be well found and soundly backed by statistical, historical or operational experience 
from credible sources. 


4.1.3 Risk-Based Approval Process — The Future Procedure 


The risk-based approval process is different from the conventional, as risk-based 
ship design adds another set of criteria to the final selection of the design, also aim- 
ing to achieve required safety standards cost-effectively (safety of life and protection 
of property and environment). An optimum design solution that includes safety is 
possible only through risk-based design, because safety is treated as a design objec- 
tive concurrently with the commercial objectives (Fig. 4.5). 
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Fig. 4.5 Approval flow diagram for the risk-based design 


As mentioned previously, one of the chapters within SOLAS that has driven the 
development of the risk-based approval concept to a usable extent is the chapter on 
fire protection, SOLAS Chapter II-2, regulation 17. 

Currently, SOLAS has two accepted methods for approving designs and arrange- 
ments for fire safety. 


1. The common prescriptive regulation set out in the parts B, C, D, E or G referring 
to specific topics such as prevention of fire and explosion, suppression of fire, 
escape, operational requirements and special requirements. 

2. The new part F regulation 17, referring to alternative design and arrangements, 
applying to a specific fire safety system, design or arrangement for which the 
approval of an alternative design deviating from the prescriptive requirements of 
SOLAS Chapter II-2 is sought. 


Today both methods are equally acceptable by the administrations. But due to the 
novelty of regulation 17, this procedure has only been used in few cases. Hence only 
few Administrations have developed standard rules and procedures for this risk- 
based approach. As the use of alternative designs has been dominated until now 
by cruise ship cases, and due to the fact that the dominating Flag states delegate 
this work to recognised organisations, there may be more experience in some major 
Classification societies (e.g. DNV, GL etc.) 

As with the present approval process, compliance with class rules, international 
and flag state regulation is part of the foundation or basis for a design. 

By evaluating compliance step by step, any rules challenged can be identified, 
thence following a path similar to what is described in the paragraphs on equivalence 
in the present approval process. 

However more risk-based requirements are being adopted within SOLAS, even 
though still not in force: 
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The new Regulations H-1/55 and II/38 that will enter into force on 1 July 
2010. This requirement will give future steps for approval of alternative design. 
MSC/Circ.1212 (IMO 2006) that outlines a methodology for the development of 
the required engineering analysis will support these two regulations. 

Resolutions 239(83) and 240(83) which will enter into force on | July 2009 de- 
fine the new format of Ship Safety Certificate with the purpose of stating the risk- 
based nature of a ship. 

Finally the Goal Based Standards being discussed at the IMO introduce the Ship 
Construction File (SCF) concept that may become independent mandatory require- 
ments under SOLAS Chapter II-1. 

The SCF, which contains drawings and information on materials/construction of 
hull, machinery and equipment, remains with the ship through changes of owner- 
ship, classification and flag. 

Within SAFEDOR thoughts and considerations on how to develop a new ap- 
proval procedure have been developed. The purpose is to define and describe a 
high-level process for novel and risk-based ship types providing a sound and har- 
monized approval process to be used by the Approval Authority in order to ensure 
that novel and risk-based designs are handled safely and efficiently. Furthermore the 
work serves to make the approval process more transparent and logic to understand 
which should ease the process for clients seeking approval. 

The following figure illustrates the novel approval process (Fig. 4.6). 

The task pending with the Administration throughout the transitional period, 
largely consist of verifying the quality of the documentation submitted. 
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Fig. 4.6 Novel approval process developed in SAFEDOR (Wentworth et al. 2005) 
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As such, the Administration has a supervisory function, in terms of ensuring the 
soundness of the sources of information applied, whether approvable methodology 
is utilised, monitoring for proper generation of acceptance criteria and ensuring that 
the group of experts is indeed covering all relevant fields of knowledge, at least to 
the satisfaction of any minimum criteria set out in advance of the actual approval 
process. 

Rendering explicit the safety levels of the existing prescriptive regulation is a 
task which is presently being addressed. This may eventually pave the way for com- 
parison with new and untested principles, along with predictions by means of proba- 
bilistic tools e.g. as described in various deliverables within SAFEDOR concerning 
the risk-based design. 

When new design projects bearing alternative features are submitted for ap- 
proval, the Administration may utilise a number of tools already provided for to 
ensure a sound approval basis. One of these is the Formal Safety Assessment (FSA) 
procedure. 

In the IMO guidelines for FSA, a number of “tools” to eventually achieve a 
concise evaluation of inherent risk and safety levels in any given project, design, 
operation or regulation are described, the result eventually being a “Safety study” (in 
principle equivalent to the Offshore sector “safety case” documenting all reviews, 
analyses and evaluations that may have taken place for the particular project). In 
most cases the FSA is a safety case for the Rules and Regulations. 

The methodology, as per below (concisely described in the circular) may to some 
extent be applied at any given approval process level, as it contains core elements of 
the considerations which would in any case have to be investigated by the Authority 
to render any alternative approval process safety-wise acceptable (Fig. 4.7). 

In this manner, evidently — provided of course, the safety study is devised with 
care and all due regard to sound scientific principle — the regulating body has a sound 
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Fig. 4.7 FSA process excerpt from MSC/Cire.1023 Annex (IMO 2002b) 
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tool to evaluate compliance by comparing risk and safety, querying for mitigating 
measures (Risk Control Options) where any risk may not have been reduced to what 
is reasonably possible at the design stage. 

From the approval in principle, through the safety assessment in its integrity 
to the notification of compliance in principle, it should at all times be verifiable 
whether the sources of data used are sound, reliable and unbiased. To facilitate the 
process of approval, it may be relevant for the Administration to develop guidelines 
of its own on acceptable data sources, approval and audit methodology, accepted 
industry standards (- or minimum standards) as well as paving the way for database 
material on alternative approval cases, which might, if relevant, be shared selectively 
within the Community to build common ground. 


4.2 Acceptance of the Alternative Design 


As mentioned previously, risk-based ship design is expected to focus on selected 
elements or aspects of ship design. The overwhelming part of the ship will still be 
using prescriptive rules, but at some point of novelty of design the risk based design 
process will be taking over as directing the process, whilst prescriptive rules may 
still play a considerable part in detail design. A complete risk-based ship design is 
expected only in relatively rare cases. Based on this, three design categories may be 
distinguished: 


e Partial risk-based design using safety equivalence for one selected function 

e Partial risk-based design using safety equivalence and safety balance addressing 
several functions 

e Complete risk-based design 


Following from the above, decision-making in risk-based design depends on the 
complexity of the attempted design and the expected proof of compliance. Hence it 
is difficult to develop one single procedure on how to accept the alternative design. 
In the following, relevant elements of SOLAS are referred: 


4.2.1 Safety Equivalent Provisions in SOLAS 74, ICLL 66 
and STCW 95 


The international maritime safety convention has always contained provisions, 
which make it possible to deviate from the prescribed requirement. Even if the- 
ses provisions do not assume the use of a risk based approach, they should, when 
it comes to complying with the requirement in the international safety conventions, 
be considered in these contexts, as “the equivalent provisions” in many cases will 
be the formal basis for the use of a risk based approach in the maritime industry. 
When “the equivalent provision” is used, the owner has, in accordance with the 
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conventions, to satisfy the Approval Authority that the equivalent fitting, material, 
appliance or apparatus, or type thereof is at least as effective/safe as that required 
by the present regulations. 

The cause for this provision is to allow the shipbuilder and the owner some flex- 
ibility and also to make it possible to take advantage of the technological develop- 
ment in the maritime industry. It has always been feared, that this possibility was 
bound to open the door to a very wide diversions from standards, but experience has 
shown, that such fear is uncalled for. Experience does also show, however, that ship- 
builders and owners rarely make use of theses provisions, as they fear, possibly with 
some justification, that an equivalent measure approved by one flag state, would 
not necessarily be approved by another flag state, having potentially severe conse- 
quences for the operation and second hand value of the ship. Furthermore, port state 
control has made it even more risky for the owner to use “equivalence provisions”, 
as an owner could find himself in a situation where it is difficult to convince a port 
state inspector that the equivalent measure is in every respect at least as effective as 
that required by the regulations. 

Another hindrance to the use of “equivalence provisions” is, that there is no in- 
ternationally accepted way to prove and document that the equivalent measure is 
sufficiently effective, and instructions on how all the various parties involved in the 
approval and the control of the ship, such as flag state, port state, classification, 
charter, insurance and finance, shall deal with such documentation. 


4.2.2 SOLAS IT-2/17 Related to Fire Safety 


In July 2002, the new SOLAS Chapter II-2 on fire safety entered into force. It con- 
tains the previously mentioned new regulation 17 on alternative design and arrange- 
ment. It explicitly states that fire safety designs and arrangements may deviate from 
prescriptive requirements provided that fire safety objectives and functional require- 
ments are met. An engineering analysis based on the guidelines (MSC/Circ.1002, 
IMO (2001)) is required to prove the case. 

Only alternative designs and arrangements that are suitable to satisfy the fire 
safety objectives and functional requirements can be considered. This, however, in- 
cludes a wide range of measures, including alternative shipboard structures and sys- 
tems based on novel or unique designs, as well as traditional shipboard structures 
and systems that are installed in alternative arrangements or configurations. 

The case requires analysis of the original (prescriptive) design and of the alter- 
native design for the purpose of comparing safety levels. This means that a relative 
and not an absolute level of fire safety is documented or achieved. It also require two 
analyses, one for an existing standard design (to find the implicit level of safety) and 
an analysis of the proposed design (do demonstrate equivalence). 

Fortunately, in due time, many such analyses will improve the knowledge of the 
implicit safety levels. FSA studies will have the same effect. Today we already see 
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many ship designs with alternative arrangements related to fire safety, following 
SOLAS-IL.2/17 and the process as outlined in MSC/Circ. 1002. 

At MSC82, a broadening of the safety equivalence for systems was agreed and 
this is documented in MSC/Circe.1212. Unfortunately, MSC/Circ.1212 only partly 
reflects on MSC/Circ.1002 and the FSA guidelines. Another obstacle is that it is 
set to enter into force only in 2010, effectively blocking any changes until then, 
because regulations can only be amended after they enter into force. Collectively 
however, FSA guidelines, MSC/Circ.1002 and MSC/Circ.1212 constitute a good 
part of a modern regulatory framework that is needed to facilitate risk-based design 
and approval. 


4.2.3 Future Regulations Allowing for Alternative Designs 


Future steps for approval and operation of alternative design will be introduced 
when the two new regulations of SOLAS will enter into force in 1 July 2010. Reg- 
ulation H-1/55 will allow alternative designs and arrangements for machinery and 
electrical installations, as well as the Regulation III/38 will allow the approval of 
alternative design and arrangements for Life-saving appliances and arrangements. 

As for current Regulation I-2/17, Regulations II-1/55 and III/38 also require 
an engineering analysis to be submitted to the Administration in order to provide 
technical justification for alternative design and arrangements. 

As for the MSC.1/Circ.1002, the MSC.1/Cire.1212 contains the engineering 
analysis methodology and the forms of the “document of approval” and “report 
of the approval” of the alternative design to be carried on board the ship. 


4.2.4 SOLAS IT-1 Related to Damage Stability 


Well aware that the SOLAS requirements to damage stability are about to be 
changed (1 January 2009) it is relevant to mention the SOLAS 90, Chapter I-1, 
regulation 25 requirements in this context too. The requirements indicate that alter- 
native arrangements are acceptable, if at least the same degree of safety as repre- 
sented by the regulation is achieved. However, each case must be reported to IMO 
individually. Resolution A.265 (VII) defines subdivision and stability equivalent to 
regulation 25 of SOLAS. 

The rules require that the attained subdivision index A is larger than or equal to 
the required subdivision index R. The subdivision index R is prescriptive in nature 
as it depends on ship length and persons onboard including life boat capacity. No 
other operational aspects are included into R. The attained subdivision index A sum- 
marizes the probability of flooding for each compartment multiplied with the con- 
sequences this flooding may have. 
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Although the determination of A is of a prescriptive nature, the concept generally 
enables probabilistic elements. Indeed, the HARDER (1999) project investigated 
all elements of the existing approach and proposed new formulations taking into 
account probabilistic data. 


4.2.5 SOLAS 2009 Will Replace SOLAS 90 


The SOLAS 90 damage stability requirements did have three alternative approaches 
to evaluate the damage stability of a ship for approval: For cargo ships, subdivi- 
sion and damage stability should comply with regulations contained in part B-1 of 
SOLAS Chapter II-1, whereas passenger ships should comply with either part B of 
SOLAS Chapter I-1 or be in accordance with the requirements in resolution A.265 
(VOI) (MSC/Cire.574 (IMO 1991)). Part B of SOLAS Chapters II-1 contains deter- 
ministic rules for subdivision and stability for passenger ships. 

Both part B-1 of SOLAS Chapter II-1 and the requirements according to res- 
olution A.265 (VII), however, describe probabilistic standards for subdivision and 
damage stability. Both the prevailing probabilistic standards for damage stability are 
based on subdivision indices, i.e. a required subdivision index and an attained subdi- 
vision index. The attained subdivision index, A, is associated with the survivability 
of a specific ship, i.e. the probability of surviving conditional on flooding of one 
or more compartments. The required subdivision index, R, determines the degree 
of subdivision to be provided and is thus intended to make sure that all ships meet 
a minimum standard of subdivision. Mathematically, the probabilistic standards of 
damage stability can be expressed as follows: 


A>R 


and 
A = pi Si 


where i denotes each compartment or group of compartments under consideration, 
p; denotes the probability that only the compartment or group of compartments i 
is being flooded and s; denotes the probability of survival given flooding of the 
compartment or group of compartments i. The required subdivision index can be 
assigned an appropriate value and is thus a damage stability performance criterion 
that can be applied for comparison to when evaluating the damage stability of a 
given ship. 

The two different probabilistic standards for damage stability in part B-1 of SO- 
LAS Chapter II-1 and A.265 use different methods to calculate the attained and 
required subdivision indices. Regardless of the method applied for calculation of 
the indices, the fundamental approach remains to apply the indices as evaluation 
criteria for subdivision and damage stability. 

If criteria based on the required subdivision index should be regarded as valid 
within a risk based regulatory context, the damage stability standards should be 
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related to some general risk model, i.e. the impact of damage stability on the overall 
risk level should be modeled. This was done in the FSA Cruise (Denmark 2008a) 
and FSA RoPax (Denmark 2008b) demonstrating that the required R was not in 
agreement with the high level criteria and therefore the requirements needs to be 
raised. 

Resolution A.265 (VIID restrictively prescribes several other aspects related to 
damage stability, including machinery bulkheads, double bottoms, openings in wa- 
tertight bulkheads, openings in shell plating below immersion line and watertight 
integrity above bulkheads. Here, no deviation from rules appears possible without 
referring to Regulation 5 of SOLAS Chapter 1 (concerning equivalences). 


4.2.6 High-Speed-Craft Code Requirements for Selected Systems 


Annex 4 of the High-Speed Craft (HSC 2000) code details the procedures for failure 
mode and effects analysis (FMEA) for selected systems such as directional control 
systems, machinery systems and their associated controls, electrical system, taking 
into account the effects of electrical failure on the systems being supplied, and the 
stabilization system. 

It states that analysis of failure performance may be used to assist in safety as- 
sessments. This indicates that FMEAs are only considered part of a broader safety 
assessment. It is also important to understand that the required FMEAs are not 
integrated into a ship-wide analysis. Each system is analyzed as a stand-alone 
system. 

The procedure include a system definition, block diagrams, identification of po- 
tential failures, evaluation of possible effects, identification of detection methods 
and corrective actions, assessment of probabilities of failures with catastrophic or 
hazardous consequences, development of a test program and documentation. 

A test program is required to support the conclusions from the FMEAs. It is 
proposed to include all systems where failures would lead to major or more se- 
vere effects, restricted operations or any other corrective actions. Test shall also 
include investigations into layout of control stations and the existence and quality 
of the operational documentation with due regard to the pre-voyage checklists. 


4.2.7 Different Acceptance Criterion Philosophies 


SOLAS provides the possibility of using alternative designs. Often, however, it is 
left to “the satisfaction of the Administration”, whether a design is acceptable or 
not — and various philosophies behind the accept criteria can be applied. 
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4.2.7.1 Risk Evaluation Criteria at IMO 


Risk evaluations criteria normally place the risk in one of three categories; intol- 
erable/unacceptable, tolerable and negligible/broadly acceptable. Risks that are as- 
sessed to lie between the boundaries for intolerable and negligible will normally be 
required to be kept “As Low As Reasonably Practicable” or “ALARP”. Additional 
criteria for what is reasonably practicable are thus needed and for safety this is often 
given in terms of the Cost of Averting a Fatality, e.g. CAF. 

Similar cost effectiveness criteria for environmental risks related to accidental oil 
spills are the Cost of Averting a Ton of oil Spilt, e.g., CATS. The currently available 
risk evaluation criteria are summarized in Chap. 3. 

Available risk acceptance criteria are related to safety of human life. Both indi- 
vidual and societal criteria are documented and their use is promoted by the FSA 
guidelines. 

Risk acceptance criteria related to the protection of the environment beyond the 
CATS criteria are not yet documented but work is being conducted to develop a 
societal acceptance criterion related to oil spills. 

This issue is described in detail in Chap. 3 of this handbook. 


4.2.7.2 Risk Acceptance Criteria for Main Ship Functions 


Setting acceptance criteria for ship functions requires that the functions are defined 
first. Among these functions are structural integrity, watertight integrity, stability, 
the capabilities for propulsion, power supply, communication, navigation, manoeu- 
vrability, sea-keeping, emergency control, habitability and cargo handling. Work 
reported in Chap. 3 addresses acceptance criteria for these functions and concluded 
that additional work needs to be done to establish acceptance criteria. 

It was underlined that for several ship functions and systems, safety is not be 
the dimensioning issue for acceptance criteria may therefore be irrelevant. Instead, 
reliability or availability dimensioned by commercial considerations is expected to 
be the more important requirements for functions such as propulsion availability 
and capability. 

Based on work related to target reliabilities for structures the SAFEDOR report 
proposed as general procedure to determine acceptance criteria for main ship func- 
tions and systems the following four steps: 


e Develop a risk model that include the function in question—all scenarios that are 
affected 
Use Cost-Effectiveness criteria 
Derive the requirement (availability, target reliability etc.) 
Use this as target in Risk Based Design. 


This issue is described in some detail in other Chap. 3 of the handbook. 
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4.2.7.3 Cost-Effectiveness 


Current decision-making with relation to safety at IMO and classification societies 
employs cost effectiveness as central decision-making criterion. It is well rooted and 
used within the ALARP principle. Main advantages are that existing criteria (CAF, 
CATS) can be used and easy integration into the traditional design framework. How- 
ever, only design changes can be assessed. Note that this apparent disadvantage is 
not considered a true disadvantage, since most ship designs are not completely new 
but are almost always adaptations of existing designs. It is therefore clearly recom- 
mended to use cost-effectiveness for decision-making in risk-based design. 

To find an adequate balance, we need to be able to draw on qualified person- 
nel, acquainted with the process, the philosophy and the techniques of risk based 
approval. 

This issue is described in detail in other chapters of this book. 


4.2.7.4 Risk Balance 


In principle, safety equivalency can be used for all functions, systems, sub-systems 
and components. Based on the same philosophy as for the damage stability require- 
ments, each function could be treated the same way, imposing similar requirements. 
This is illustrated in the figure below, using the symbols from the approved new 
damage stability regulations (The attained index (A), which is an estimate of the 
probability of surviving a collision with water ingress, is required to be larger than 
the R; R is then a risk-based acceptance criterion for damage stability). 

This concept may be illustrative as it is intuitive. This is, however, a simplification 
that will not be generally valid. The condition for using this approach is that the 
innovative design solutions do only affect one of the functions or systems. In most 
cases an innovative solution may affect multiple function and accident scenarios. In 
such cases this description may be too simplistic. 

The second route would need explicit safety levels against which to design. This 
second route probably is necessary for future trade-offs between several aspects of 
ship design (e.g., damage stability and life saving). Safety levels and acceptance 
criteria are key elements of the future regulatory framework and the next section 
discusses these in more detail. 

In the short- and medium-term, only partially risk-based designed ships are ex- 
pected. Thus, prescriptive and probabilistic rules need to be applied together. This 
coexistence certainly is a challenge for the regulator as elements from one design as- 
pect (e.g., bulkhead positions related to damage stability) frequently influence other 
design aspects (e.g., cargo capacity, strength and outflow of fluids, to name a few). 

For each element in ship design challenging current rules in isolation, safety 
equivalency appears to be the best way ahead for the time being. It offers the de- 
signer freedom for alternative arrangements and/or equipment and offers to the reg- 
ulator a method for approval which closely follows the SOLAS-II.2/17 approach. 
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Fig. 4.8 Risk balanced acceptance criteria 


The challenge, however, is to define the equivalent design and designing a second 
ship just for reference purpose is certainly not cost-effective. 

The regulatory framework of the future has to facilitate full optimization of safety 
which is expected to become visible when two or more aspects or functions of ship 
safety are becoming traded off against each other. It is well known that many ship 
functions contribute to the overall safety of the vessel. What is not known explicitly 
is the share each function actually contributes (Fig. 4.8). 

A collection of ship functions that contribute to safety are presented in the figure 
with elements marked in Blue indicating that requirements Rxy are set by IMO 
and/or class, and with orange-marked elements indicating those requirements which 
are probably specified by the owner, i.e., owner’s requirements are stricter than IMO 
requirements. Note that for each function, an individual R will have to be specified 
together with a procedure to determine A. 


4.3 Stakeholders in the Approval Process — How Do They 
Work Together? 


Assessment and approval of risk-based ship design is a special branch of knowledge, 
and special qualification needs and experience become necessary to carry out such 
projects. Also, the operation and inspection may require new skills, or a modification 
of existing methods of work. 

Risk based design has for many years been used in other sectors, such as nuclear, 
offshore, hazardous, and the aerospace industries. 
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Existing knowledge and experience from other sectors has, however, only to a 
very limited extent been used in the maritime sector, and thus, there is merit in 
phrasing guidelines on qualification upgrades to the key personnel responsible for 
design, assessment, approval and operation, to facilitate an adaptation to the mar- 
itime industry. 

The challenge in defining which qualifications are required through a process of 
designing, building, approving, operating and inspecting a risk based vessel is not 
only to define an adequate level of knowledge, but also to differentiate between the 
knowledge levels required from the various stakeholders. 

However it is also necessary to define base line requirements, starting from a level 
of knowledge required to perform duties, involving risk based designs, where these 
duties only differ marginally from such being performed on a traditional design, up 
to a level of knowledge required to analyse on the design itself and on the involved 
systems. 

Also, an attempt is made to identify key subjects, of which it will be necessary 
to attain knowledge, depending on the work the concerned individual is tasked to 
perform. 

When determining the requirements to key personnel involved in the assessment 
and approval process, it is useful to categorize the various stakeholders by mapping 
their contribution to the process including the interests they represent. 

The following maps cover different stakeholders contributing to the various 
phases in the design and operation: 


e The documentation sequence starts with the “Production map”. This map ad- 
dresses stakeholder involvement in the sequence from the Concept design de- 
scription up to submission of documents for approval to the authorities. 

e The next sequence is the “Process map”, which covers the stakeholder involve- 
ment in the process up to the granting of approval to the Owner from the 
Authority. 

e The “Retention map” describes the stakeholder involvement with documents re- 
quired to be kept available after approval as working documents, or as a basis for 
further developments. 

e The “Control map” describes the stakeholder involvement with documents re- 
quired to be inspected upon request if the vessel is subject to survey, Port State 
or class inspectors. 


The maps are categorized in several parts referring to the various elements of 
documentation and information throughout the life of the vessel. 


4.3.1 Design and Construction Phase 


Concept design description, drawings and documents is the preliminarily available 
description, drawings and any obtainable further descriptive documentation, which 
may serve to inform on, how the design meets its measures of efficiency. 
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Hazid investigation refers directly to the IMO formal safety assessment 
methodology. 

Approval in principle statement is a statement from Administration/Approval 
authority, that the design/the project are conditionally acceptable, subject to re- 
evaluation as the construction entails. 

Risk assessment, analysis and detailed documentation The engineering analyses 
and test are used to verify that the design is feasible with respect to intentions and 
overall safety in all phases of operation. The analyses and test will ensure that the 
novel or risk-based design will meet expectations from a functional and safety point 
of view. 

Approval of the design the approval of the design indicates to the owner of the 
project, that the risk based vessel or system lives up to the level of safety required 
by the approval authority. 

Certificates documentation on the compliance of a vessel or system with regula- 
tion or the stated intent of regulation. 

Ship Construction File, SCF, is a document suggested to contain all information 
relevant for a risk based design. Whether the analyses and the risk model originally 
applied should be part of the file is still debated internationally. Presently the SCF 
is undertaking development at the IMO. 


4.3.2 Operational Phase 


Summary of the design details/Port State Control-file: A file that summarily states 
any deviations from prescribed practice, high level risks, residual risks and the 
means to mitigate them and references to risk assessment and maintenance pro- 
cedures in the Safety Management System. The file also contains statements of ap- 
proval and/or granted equivalences from the Authority. 

Safety Management System, or SMS. Usually these systems are very compre- 
hensive. They describe all safety relevant tasks, anticipated risks, accident records, 
reporting and corrective action processes, maintenance tasks as well as routing of 
information in the organisation. The Safety Management System is used on a daily 
basis on board, as work permits, records and checklists are an integral part of it. 

Combining the four maps serves to monitor the level of involvement for the main 
stakeholders in the process. The markings of each of the previous maps have an own 
signature in the combined map. 


Production map 
(Who is likely to produce the documents in question) 


Process map 
(Who needs the documentation to proceed in 
the construction or approval process) 


Retention map 
(Who retains the information after commissioning) 


Control map 
(Who may require access to the documentation 
during operation) 


OOOO 
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The amount of markers along a stakeholder line indicate an involvement in the 
process in one or more of the phases, whereas the tint of the perimeter quadrants 
indicates the stage the stakeholder is involved in. 

The two upper quadrants are mainly relevant during design, approval and con- 
struction, whereas the two lower quadrants will become increasingly important 
when a vessel approaches the operational phase. 

A high level of involvement does not necessarily generate qualification upgrade 
requirements, as these will depend on the currently available qualifications (which 
we will discuss later), but it provides an indication of the stakeholders which will 
in particular have to scrutinize the potential and challenges in their organisation 
(Fig. 4.9). 

The above illustrates a typified situation, and other constellations are possible. 

From the combined map, the following categorization of the stakeholders is 
drawn: 

Designer: Involvement is concentrated in the design and construction phase, and 
qualification upgrade focus is on application of risk based design tools. This means, 
that the designer will have to scrutinize his organisation, to verify whether the nec- 
essary expertise on such tools is available, or has to be developed. 
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Control map 
(Who may require access to the documentation 
during operation) 


Designer 


Shipyard / Subcontractor 


Owner / Client 
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Consultants / External experts 


Flag State 


Approval 


Classification Society 


Supervisors / Surveyors 


Port state control officers 


Operation 


Crew 


Fig. 4.9 Combined qualification map Winther and Juhl (2008) 
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Yard/Subcontractor: Even if involved with the risk based feature(s), the yard is 
likely to focus on the building specification, as well as the details to be submitted 
for the operational stage (if the design has been bought from designers/consultants), 
and a substantial amount of effort with regards to risk based features will arise when 
compiling the SCF, which is assumed to contain all relevant documentation pro- 
duced in the design and construction phase. 

Owner/Client: Attains a major role in the risk based project. The owner is re- 
sponsible for fulfilling any requirements specific to his project as well as initiat- 
ing assessment and analysis of any alternative features. The owners’ involvement 
prevails consistently from selection of design/setting requirements to the design 
through the approval and construction phase up to and through the operation phase. 

Consultants/external experts: As consultants and external experts are mainly 
involved with the production of material related to risk based features, their knowl- 
edge with regards to risk analysis and risk based methodologies and approaches is 
required to be substantial. As this is a prerequisite to perform analysis, consultants 
can be called upon, if insufficient qualifications are found with other stakeholders. 

Approval authority/Administration: The approval authority will encounter risk 
based approaches through all stages of a lifecycle, and through all steps of the pro- 
cess (as will the RO/classification society) to varying levels, by being involved in the 
approval in principle, by setting requirements ensuing the risk assessment, granting 
final approval, by way of inspections on registration and later, at port state inspec- 
tions. This again requires the authority to possess a variety of types and levels of 
knowledge with respect to risk based approaches. 

Recognized organization: Are involved in both statutory and commercial issues 
pertinent to risk based approaches, and are also confronted with vessels at all stages 
of a life cycle. As it is evident from the map, the RO is also involved at most stages in 
the process. Thus, knowledge on risk based approaches should be widely available, 
on an expert level as well as more operational knowledge, depending on the roles 
assumed by the RO. Some Classification Societies acting as Recognised Organisa- 
tions have extensive experience with risk based approaches applied in the offshore 
industry for years, thus some expertise is already available. 

Supervisors/surveyors: When supervising the construction of a vessel, it is nec- 
essary for this stakeholder group to comprehend the conditions for approval, espe- 
cially if these are of a risk based nature. The features are expected to become part of 
the specification, and the task of supervisors will thus not change significantly. The 
level of expertise required may be limited, due to the lack of in depth involvement 
with individual vessels. 

Port state control officers: PSC-officials have to be acquainted with the fact 
that vessels can be approved with arrangements which are not in conformity with 
standard vessel designs. They are concerned with the vessel in operation, and will 
not be required to produce or process the information from the design and approval 
phases but will mainly require access to documentation. The qualification upgrade 
needs are hence not expected to be substantial. 

Crew: For the time being, the crew is relatively uninvolved in the production 
of on board documentation, even if changes to the SMS may be instigated by on 
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board operational experience. The new building crew is usually involved with a 
project from a relatively early stage, and ideally, their knowledge of the vessel in- 
creases through the construction phase. The crew retains and handles the on board 
documentation, and wherever special requirements to maintenance, manoeuvring, 
reporting or supervising become relevant, the crew should be aware of the features 
and the decision making basis arising from the risk based approaches applied. 

Qualification requirements are of course pertinent to all parties involved in the 
process, as this is the only way to ensure a sound decision making basis. However 
the map also shows where it is necessary to ensure or even enhance qualifications, 
because the specific stakeholder has a crucial role in the design process, e.g. owner, 
Approval Authority, Recognized Organizations — and the crew. The latter is maybe 
not that obvious. 

When first identified, it is much easier to focus adjustments to qualifications. 
However all parties need a familiarization process, to a level of knowledge in accor- 
dance with their type of involvement in the risk based design. 

As seen from the qualification maps some stakeholders will necessarily have a 
highly intense level of involvement with a risk based design, throughout the life 
cycle of the project. Given the concerns on recruitment in the maritime industry, fi- 
nancial resources and career options within an organisation are primary motivational 
factors for attracting qualified candidates for open positions. Some of the stakehold- 
ers mentioned necessarily have greater potential for attracting qualified candidates. 

Due to organisational size and resources, owners, recognized organisations, con- 
sultants and to some extent designers and yards have relatively high recruitment 
potential, should they require expertise that they do not possess, while other stake- 
holders may have to upgrade existing personnel due to limited recruitment poten- 
tial (limited size or limited financial flexibility, for instance with public authorities, 
crewing agencies, universities/research institutes - the trend can be confirmed by 
comparing the number of qualified applicants for maritime technical position with 
the respective stakeholders). 


4.4 How Do Risk-Based Design and the Associated 
Approval Work Together? 


Approval of risk-based ships and their systems — often called risk-based approval — 
is the process to identify and resolve issues relating to the regulatory acceptance of 
the proposed design. Obviously, the approval process needs to take into account the 
risk assessment for the ship and its systems and, therefore, a careful review of risk 
analysis and establishment of risk acceptance criteria are central elements of the 
approval process. 

Currently accepted and used risk-based design approaches are two-step ap- 
proaches involving qualitative and quantitative steps. The currently proposed risk- 
based approval process is also a two-step process. The qualitative step ends with a 
preliminary approval which documents the requirements for the full approval. The 


176 J.S. Juhl 


obvious question for future risk-based design is how much effort is needed upfront 
to explore the design solution space before preliminary approval from an approval 
authority. 

New activities within risk-based design and approval processes have to be aligned 
with existing schedules for owners, yards and suppliers. Ideally, a yard seeks to 
build-up complete knowledge of the expected risk analysis and its results before the 
contract with the owner is signed. This means that significant amount of analysis 
may have to be carried out prior to application for preliminary approval and before 
the detailed approval requirements are issued. On the other hand, investing too much 
before an indication of feasibility is not advisable. 

Key milestones in the combined schedule are presented in the figure below, show- 
ing on the left yards’ activities, in the centre the owners’ actions and to the right the 
approval authorities’ steps. It is emphasized that the shown alignment may vary 
according to the actual case. 

The depicted alignment of schedules indicates that after signature of the letter of 
intent, the yard commences the production of a full design concept which is then 
previewed with the approval authority to decide whether a risk-based approval is 
needed or not. If needed, the qualitative phase of the design and approval is entered 
which concludes with the preliminary approval by the approval authority. Once the 
conditions attached to the preliminary approval are known — and are acceptable — 
the yard approaches the owner to sign the contract. Following this key milestone, a 
quantitative analysis is started which — together with the traditional design activities 
in this stage — eventually result in an approved design (Fig. 4.10). 

Partners of SAFEDOR have intensively debated the above schedule. In particular, 
the discussion centered on how much effort by the yard or designer is spent before 
the letter of intent. For truly challenging and large projects, the quantitative part of 
the risk assessment is most likely carried out before the letter of intent and, therefore, 
well before the preliminary approval. 

The main reason is that yards do not want the process to be interrupted by the 
relatively late preliminary approval. Yards ideally seek to have all issues affecting 
the design and approval process solved before applying for approval. 

It is noted in this context that one objective of risk based design is to increase the 
knowledge about the ship design in the early design phase and, therefore, facilitate 
decision making. Thus, with advanced tools available, a risk analysis on key as- 
pects can be performed cost-effectively before a letter of intent is signed. Note that 
this early design activity was presented in the introduction as a risk-based design 
optimisation. 

Taking into account the above discussion, the alignment of owner and regula- 
tory processes is more or less fixed. The alignment of the design process can vary 
depending on the level of challenge. 

In the shown schedule, the design concept is established before the signing of the 
letter of intent. More importantly, the design concept is enhanced by a preliminary 
risk assessment involving preliminary HazlId, qualitative risk ranking, risk analysis 
and evaluations of risk control options. 
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Shipyard’ activity Owner’ activity Approval Authority’ activity 


| Owner identifies need for new ship 


Call for tender 
Tender documents = = = 
Owner reviews quotations | 


LETTER OF INTENT SIGNED —j 
DESIGN CONCEPT ————_——_—_———_—_——_— Design preview 
| Preliminary specifications agreed 


Define approval basis and 
acceptance criteria 


Perform HAZID 


Monitor / review HAZID 


Qualitative ranking of risks 


PRELIMINARY APPROVAL 
(with conditions) 


CONTRACT SIGNED | 


Establish risk model 


Final specifications agreed 
Perform frequency and Review of risk assessment 
consequence assessment 


Time line of key steps in a “normal” design project 


Definition of detailed requirements 


Evaluate risk control options Review of analysis and testing 


Finalize design Approval of documents 
(with conditions) 


ISSUE OF CERTIFICATS 


Milestones in the project 


Fig. 4.10 Overview of key steps for “normal” projects 


The yard thus establishes a clearer picture on the feasibility of the concept prior 
to signature of the letter of intent. Obviously, following the design preview with the 
approval authority, only updates of the supplied documentation (HazlId, qualitative 
risk ranking, risk models, risk analysis and evaluations of risk control options) is 
expected to be required. 

It is unlikely that any ship will be entirely risk-based in the near future. 

The reason is that prescriptive rules offer a far more competitive approval basis 
than a risk-based approach for many standard elements of a ship. Therefore, risk- 
based approaches will only be applied in selected area of ship design. 

Today we already see many ship designs with alternative arrangements related to 
fire safety following SOLAS-II.2/17. Here, risk-based approval comprises a chal- 
lenge related to a single design aspect. The overwhelming part of the ship design 
is prescriptive (not risk-based) and the traditional design and approval process are 
pursued as before. 

For the rule challenge, safety equivalence is demonstrated, and if the safety 
equivalence fails (for whatever reasons), the vessel is likely to be approved and built 
with another solution in compliance with existing rules. For ship designs adopting 
this partial risk-based approval case, a schedule as presented in figure above is 
applicable. 
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Shipyard’ activity Owner’ activity Approval Authority’ activity 

Owner identifies need for new ship 

Tender documents 
| Call for tender 
DESIGN CONCEPT : 
Update HAZID 
Owner reviews quotations 
LETTER OF INTENT SIGNED 
Preliminary specifications agreed | Desionipleview 
Update ranking of risks Define approval basis and 


acceptance criteria 


Update risk model 


Monitor / review HAZID 


PRELIMINARY APPROVAL 
(with conditions) 


CONTRACT SIGNED 


Time line of key steps in a risk-based design project 


| Review of risk assessment 


Update frequency and 


Final specifications agreed 
consequence assessment 


Definition of detailed requirements 


Update risk control options | Review of analysis and testing 


Finalize design Approval of documents 
(with conditions) 


ISSUE OF CERTIFICATS 


Milestones in the project 


Fig. 4.11 Overview of key steps in risk-based design and risk-based approval 


In the future, however, a complex case of risk-based approval comprising sev- 
eral rule challenges could be anticipated. The major portion of the ship design is 
prescriptive (not risk-based). However, if the safety equivalence fails, the project 
could probably not be realised. For ship designs in correspondence with this case, a 
schedule as presented in Fig. 4.11 seems more applicable. 


4.5 Requirements to the Documentation Related to the Approval 


Due to an expected increase in the number of novel and risk-based ship designs over 
the past years, an increasing need within the maritime industry for a formal approval 
process which allows for such innovation has become evident. 

Presently, guidance exists for class approval of novel concepts. Also, guidelines 
for the development of risk based regulation have been issued within the auspices of 
the international organisation, as set out in the guidelines for formal safety assess- 
ment, FSA. 
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The form of the expected requirements set by a regulatory body for an actual risk 
based ship or system design is, however, less prominently described. 

No fully risk based set of statutory regulation for ships exist for the time being. 

When setting requirements to documentation, a main concern is, to anticipate 
how compliance to the approval process can best be recorded for later reference. 

Approval normally requires compliance with two types of rules: 


e Statutory requirements 
e Class rules/industry standards 


Even if these two types of rules at numerous instances overlap in scope and intent, 
it is important to note, that certain aspects do indeed differ. 

The justification for a statutory requirements and regulation is found in a need to 
manage risks to life and occupational health for crew, passengers and third parties 
as well as risks to the environment. 

Rules of the classification societies may have a different role, as these rules some- 
times are best practices based on more commercial considerations. 

Statutory requirements do not traditionally set detailed performance require- 
ments, corrosion margins, requirements to weld seams or minimal maintenance on 
machinery (unless such machinery maintenance may be deemed safety critical) as 
the industry, classification societies or standardisation organisations already have 
developed such rules. 

Statutory requirements will be concerned with specific features relevant for the 
preservation or rescue of lives and environment, including life saving, environmental 
protection equipment and redundancy requirements for safety critical functions. 

As we have previously stated, rules and regulations can be challenged in a num- 
ber of constellations: 


e A ship design challenging both class requirements and statutory requirements. 
(Example: A vessel applies a novel (for maritime use) type of fire protection of 
the superstructure). 

e A design, which challenge the statutory requirements, but does not challenge 
class requirements. (Example: Occupational health and safety issues (An engine 
room floor which is not adequately secure against slipping), access to radar mast 
inadequate). 

e A design, which challenges the class rules only. Due to SOLAS II-1 Part A-1, 
reg. 3-1, this situation will not be considered. 


SOLAS II-I Part A-1, Regulation 3-1: 

“... Ships shall be designed, constructed and maintained in compliance 
with the structural, mechanical and electrical requirements of a classification 
society which is recognized by the Administration (in accordance with the 
provisions of regulation XI/1), or with applicable national standards of the 
Administration which provide an equivalent level of safety.” 
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Beyond the above mentioned constellations, however, there are other instances 
whereby the rules and regulation may be challenged. Such situations require in- 
creased attention due to rising numbers of novel and risk-based ship designs. Hence 
these largely unregulated situations are likely to occur: 


e A design which is an entirely novel concept (no comparable or equivalent de- 
signs exist) 


Example: a Panamax cargo vessel built in carbon fibre material, a container 
vessel exceeding the dimensions covered by the rules. 


e A design, which does per se not challenge neither class nor statutory require- 
ments, whereas the intention of the rules does not match the intended scope of 
operation, and leaves this in essence unregulated. 


For obvious reasons it is important to all stakeholders in the approval process to 
find a commonly accepted level in relation to the amount and type of documentation 
to be submitted prior to acceptance of the design. The balance to be achieved is 
that of an adequate level of documentation, conceived as the necessary amount of 
information without being redundant. 

Traditional approaches to achieving safety on board ships have involved the 
adoption of a number of complex and often disjointed requirements for different 
components of the system “ship.” The value of each to the overall design objective 
is sometimes unknown and the complementary or compensating nature of these pro- 
visions cannot be quantified. Hence it is of most importance to the novel design that 
competent personnel deals with all links of the design chain. 

A design team acceptable to the Administration needs to be identified (probable 
at day | of the project) by the owner and may include, as the alternative design and 
arrangements demands, a representative of the owner, builder or designer, and ex- 
pert(s) having the necessary knowledge and experience in safety, design, equipment, 
and/or operation as necessary for the specific evaluation at hand. 

Other members may include marine surveyors, vessel operators, safety engineers, 
equipment manufacturers, human factors experts, naval architects and marine engi- 
neers. The levels and types of expertise (including construction, automation and/or 
human interaction) that individuals should have to participate in the team may vary 
depending on the complexity of the alternative design and arrangements for which 
approval is sought. 

The alternative design process may involve substantial deviation from the pre- 
scriptive requirement. This means that the documentation process needs to be clear 
and transparent and well prepared to avoid misinterpretations. The alternative de- 
sign and arrangements should be clearly documented in a simple and transparent 
format, such as a comprehensive report. 

When checking that a design complies with traditional codes and guidance docu- 
ments, it is relatively straightforward to establish whether the various provisions of 
these have been correctly implemented. 
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The risk-based document, however, provides a report of flexible approaches to 
design, using performance-related objectives rather than prescriptive solutions. It is 
therefore not possible for an approval body simply to compare the proposed design 
against a set of well defined criteria. 

Due to this fact, the results of an engineering assessment should be fully doc- 
umented in a way that can be readily assessed by a third party. The report should 
set out clearly the basis of the design, the calculation procedures used and any as- 
sumptions made during the study, and pertinent aspects of the design which require 
on-going supervision, inspection or maintenance should be included in the ship con- 
struction file and specialized specific survey report kept on board. 

The novel approval procedure will be linked to each phase of the vessel life 
cycle. Table below presents the relation between life cycle phases of the vessel and 
elements of the approval procedure. The typical planning phase in design will be 
complemented by an identification of rules that will be challenged. In addition, the 
design team has to be assembled. The design phase will be risk-based and a risk 
assessment has to be performed. During the construction phase, new building survey 
needs to be directed with the help of a specific survey plan. In the operation phase, 
enhanced annual validation surveys addressing the items in the specific survey report 
are expected. 

The approval flow chart for a risk-based designed ship with safety equivalence 
can be taken from IMO (MSC/Cire 1002, IMO (2001)). The steps from FSA are 
compared with the flow chart to indicate that both approaches are compatible. 


Lifecycle phases (Novel) regulatory framework 

Planning phase Identification process 

— Market segment — Identify the relevant regulations for 
(cargo type) the transport concept 


— Transport concept (bulk, containers, 
tank) 

— Area concern (restricted waters, 
short voyages, world wide, ...) 

— Ship specification (size, tonnage, 
weather requirement, ...) 


Design phase 

— Hull 

— Propulsion system 
— Structure 

— Cargo handling 


— Survey friendly 


— Identify the availability of necessary 
experts in the design group. 
— Preliminary risk assessment 


Approval process 

— Approval of the design team(s) 

— Preliminary risk assessment 

— Plan approval 

— Final risk assessment with concern 
to the specific system. 

— Sensitivity report 

— Specialized specific survey report. 

— Ship construction file/report 
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Construction phase Approval process 
— Ship specifications — Survey and inspection related to the specialized 
— Quality of work specific survey report 
i... — Ship certificates 
Operational phase Approval process 
— Trade — 12 month enhanced validation survey related to 
— Maintenance the specialized specific survey report 
— Compliance to legislation — Periodical surveys reflecting the present 
—ISM SOLAS regime 
Operational phase II Approval process 
— Change of flag — Review of specialized specific survey report 
— Modification and ship file report 
— Periodical surveys reflecting the present 
SOLAS regime 
Recycling Approval process 
— Decommissioning — Certificate of “Clean Ship ready for 
— Basel Convention Decommissioning” 
or — Green Passport/Report 


4.5.1 The Approval Matrix — An Easy Guideline 


4.5.1.1 Project Category 


In order to rank the novelty of a design, a simple categorization may be used. Tech- 
nology in category | is proven technology used in known application areas where 
methods for classification, testing, calculations and analyses exist. Technology in 
categories 2-4 is defined as new technology, and shall follow the procedures de- 
scribed in this report. The distinction between categories 2-4 serves to facilitate the 
focusing of efforts on areas of concern. Another objective of the categorisation is 
the establishment of, whether or not the design qualifies as a novel design, and to 
align estimates of required workload with the requirements eventually stated by the 
approval authority. The categorization also serves to assist in defining the level of 
detail of the analyses required in the following phase (Fig. 4.12). 


Technology status 


1 24 
Application Area Proven Limited field New or un- 
history proven 
1. Known 1 2 3 
2. New 2 3 4 


Fig. 4.12 Categorization of new technology Winther and Juhl (2007) 
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A matrix as shown in Fig. 4.13 may be applied for guidance to the client when 
performing preliminary estimates on the extent of the work to be performed and 
submitted for approval. 

The matrix has two axes: one referring to the level of novelty in the design 
(project category); the other referring to requirements in the risk assessment and 
to the amount of documentation (row A—E). The following paragraphs are explana- 
tory notes to the approval matrix. 

Row A: Basic risk assessment: This row contains information on description of 
hazards to individuals, arising from a specific setup or operation. Reference can be 
made to existing practice; hazards are ranked in qualitative terms. 

Row B: Further analysis requirements: Due to the difference in complexity in 
the various ship designs it is obvious that a differentiation in the requirements to 
documentation is required. 


e Semi-quantitative risk assessment: A description of frequency and impact of the 
consequences of a setup or operation, qualitative as well as quantified. Scenarios 
are described, and categorized according to their probability and impact. Ele- 
ments are prioritised according to their severity (sometimes described as a con- 
sequence analysis). 

e Quantified risk assessment: A description of probability and consequence of haz- 
ards (usually to a well defined group of people) through a specific operation or 
activity. The risk levels are represented numerically to be compared with agreed 
criteria. Varying levels of depth in the quantitative risk assessment may be re- 
quired. It can demonstrate and quantify the effect of event sequences/scenarios 
which may affect structural integrity and/or may be a significant impediment to 
normal operational conditions, it can perform an evaluation of impact on individ- 
uals immediately involved or affected and quantifies potential fatalities, as well 
as amounts of environmentally noxious substances released and analyse the total 
impact on group health and the impact on the environment. 


If a qualitative risk assessment describes (and suggests reduction of risks) to a 
satisfactory level, then requirements for quantitative assessments are redundant. 

Row C: Qualifications of Analyst: This subject will be dealt with in depth in 
Chapter 4.3, but stems from the general assumption, that the client will to a certain 
extent be able to perform or contribute to at least basic risk assessment by means 
of own qualified personnel, as such assessments benefit as much from operational 
experience as from expert knowledge in specific analysis disciplines. Actual risk 
analysis, however, require specific expertise in the field. The guiding principle re- 
mains to limit the amount of external experts the client will need to employ, if a 
sufficient level of risk reduction can be achieved by relatively simpler means. 

Row D: Applied rules and guidance: This element reflects the various sources 
of regulation and guidance on specific requirements in the individual case. 

Row E: Potential additional tests, surveys and compliance control (after 
commissioning): Anticipated follow-up after construction. 

Due to the variety and difference in complexity of novel ship designs, the appli- 
cation for approval of risk based designs will be assessed on a case by case basis. 
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Furthermore, requirements for tests and analysis may vary with the confidence in the 
design within the Approval Authority. When reference designs or similar projects 
exist, and have been approved, characteristics inferred from one design may be ap- 
plied to other similar designs. 

Alternative evidence of compliance may be deemed acceptable by the approval 
authority, provided such evidence (in the form of certificates or documents of com- 
pliance) is produced as a result of testing or verification by an accredited indepen- 
dent third party. 

The responsibility for documentation, testing and analysis, as required to achieve 
a reasonable level of safety rests with the client. This is no different from the well- 
known existing approval process. 

The risk based approval process will apply a staged approach, initially stating 
conditions based on analyses of the proposed design as it is known at that stage, and 
later refining the requirements on which approval will be based, as knowledge of 
the design increases. 

Assumptions made in the risk assessment in the design phase will be subject to 
verification, and the design as such will be subject to greater scrutiny through the 
initial phases of operation than what is expected for a conventional design. 

The above is prevalent until appropriate references exist for most types of devia- 
tions from existing regulation. 

Completely novel designs will be evaluated from scratch, case by case, and can 
thus become subject to more extensive documentation requirements. It is, though, 
expected, that such requirements will be relaxed as confidence in the methods and 
techniques applied for evaluation of safety grows, as well as the knowledge base on 
potential reference systems. 

Traditionally, in the marine industry, “safety” has been interpreted as “compli- 
ance with rules”. The risk based approach, on the other hand, encourages the in- 
dustry to actively examine their goals with regards to safety, and also requires a 
re-examination of existing regulation — indeed it requires to redefine safety, and 
considers just how safe ship operations should be in the future. 

A main challenge in this process is the balance between a volume and level 
of documentation, encouraging the client to examine his design and his systems 
(without imposing extensive burdens) and at the same time supplying sufficient in- 
formation for the approval authority to have confidence in the safety of a 
design. 


4.6 Approval of Ship Systems 


The risk-based ship system approval process is based on elements as described 
above and the system approval process is often seen as a part of the overall risk- 
based approval. However, it may also be an isolated approval in case a system man- 
ufacturer wants to use the risk-based approach for a certain system. 
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The risk-based ship system approval process is based on the experience gained 
with the traditional type approval process. New steps have been introduced to 
achieve a transparent approval process minimizing the effort in each step and to 
limit the economical risk for the supplier in case of non-compliance with the re- 
quirements/acceptance criteria. 

During the development of the proposed system approval process discussions 
with ship yards shows that risk-based design is more time consuming compared to 
the traditional process. More experience with risk-based design will increase effi- 
ciency and will lead to a reduction of the time required. 

Due to the fact that additional work is required for the risk-based design and the 
approval process there will always be a difference between risk-based design and 
traditional prescriptive rule compliant design. To overcome the conflict between 
required analysis effort and available time in the bid process or realisation process, 
stand alone projects for the development of new designs are proposed. 

In the following the alignment of the risk-based system approval process with the 
shipyard’s main business process is illustrated in Fig. 4.14. The proposed system 
which includes a pre-approval process should run, if feasible, at the bid develop- 
ment stage or before as mentioned above. The specific design starts after the yard- 
supplier contract is agreed. This process will probably be iterative until an approval 
of the documents has been reached and the next step, the system construction, can 
be taken. 

Given that the system is eventually only partially built by the supplier and com- 
pleted at the yard on board a ship, some of the milestones and step transitions in the 
approval process do not need to coincide with the overall design and construction 
process (shown on the upper part of Fig. 4.14). 


4.6.1 Acceptance 


The development of acceptance criteria for main ship functions including devel- 
opment of risk models related to the specific system are crucial elements in the 
approval. 

Overall risk and ship functions are normally linked via a risk model. The risk 
model describes the relation between a ship function failure causing harm (accident) 
and the outcome of the accident (consequence). 

Ship functions explored within SAFEDOR are structural integrity, watertight/ 
weathertight integrity, stability and floatability, propulsion, power supply, 
communication capability, navigation, manoeuvrability, sea keeping performance, 
emergency control, habitability and cargo handling. The absence (failure) of one or 
more ship functions is an incident, which in case of further escalation, may cause 
harm (accident). 

The relation between overall risk and ship function can be used to determine the 
risk for a ship or a ship type or conversely to assign limit values for the different 
ship functions. As long as the relation between ship function and risk category is 
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not affected by the design process, the acceptance criteria for ship functions can be 
reduced to target failure probability. 

The relation between overall level of risk and the ship functions is not a one- 
to-one relation and thus the definition of an overall level of risk is not sufficient 
to define criteria for ship functions. For each ship function, acceptance criteria for 
safety, environment, reliability and availability shall be defined. 

The acceptance criterion for the design is the minimum risk of the risk categories 
safety, environment, reliability and availability. For the approval process only safety 
and environment are relevant. It is expected, that for a significant number of systems 
the owner’s demand for reliability will be the relevant acceptance criterion. 

It is possible to develop the functional categorisation in a hierarchical manner 
proceeding from more general requirements (e.g. propel ship at required speed) to 
specific ones (e.g. supply fuel to main engine). However, establishment of a func- 
tional hierarchy becomes progressively more difficult at lower levels. Thus, it is 
proposed to define the relationship between “systems” and “ship function” and to 
use “system requirements” for the design of systems. 

Since the acceptance criteria are specified in different levels of abstraction for 
ship functions, systems, sub-systems and components, the acceptance criteria also 
have to be broken down or distributed according to the relation between instances 
of different levels. 

This breakdown is an arbitrary process because in most cases no one-to-one re- 
lation between criteria of different levels exists. If, for example, a system built of 
several sub-systems should reach a specified failure rate, which in this case repre- 
sents the criterion, this can be achieved by various combinations of the failure rates 
of the sub-systems (taking into account possible interactions with other systems). 
Risk analysis of present ship systems can be a sound basis for the definition of fail- 
ure probabilities for systems. Evidently, a detailed model of the system is required 
and will need to be developed. 

With regard to the accuracy of the developed risk acceptance criteria and the 
process of risk analysis, it is obvious that the accuracy of the failure probability, 
for instance, determined by means of a reliability model (e.g. fault tree, Bayesian 
network) depends on the accuracy of the model itself and the data used. 

The reliability model must consider all relevant contributors to the failure proba- 
bility. However, the significance of a specific component varies with its failure prob- 
ability and the relation to that one of other components of the system. Sensitivity 
analysis will demonstrate the level confidence of the calculated failure probability. 

Guidelines for risk analysis describe the development process for the reliability 
model of the system examined, especially concerning issues like: 


e Determination of the interfaces to the global risk model (impact on ship 
functions and event trees) 
Identification of the possible risk increasing influence of a specific RCO, for in- 
stance on RCO like the net around a helicopter landing which should prevent 
people from falling from the helicopter deck, but is also a hazard source when 
a helicopter is caught up in this net. The data (failure probability) used for the 
analysis (determination of the system failure probability) influence the result, and 
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their determination will follow certain quality standards. For instance, the deter- 
mination of the failure probability of a component may be done by: 


Expert judgment 
Historical data (stochastic parameters) 
Probabilistic analysis 


Expert judgment has been used in a variety of risk analyses and it forms a good 
basis in all cases where no other data is available. Risk perception, however, may be 
a problem and, for instance, a sensitivity analysis should demonstrate the stability 
of the result. This influence is smaller in a comparative analysis (comparison of two 
designs) than in a risk analysis using an absolute risk acceptance criterion. 

Historical data are always useful; however, the data have to be evaluated to check 
the validity of the data used, e.g. is the sample representative or is the database 
comprehensive enough to calculate stochastic parameters. Appropriate methods are 
available, but not discussed in this handbook. 

In certain cases probabilistic analysis can be used to calculate the failure proba- 
bility. The applied limit state used has to be described clearly. In the risk based- 
design risk-balancing can be used in the sense of risk compensation between a 
system which violates the acceptance criteria and one or more systems which are 
sufficiently below the relevant acceptance criteria, e.g. on ship function level. The 
basic idea of risk balancing is that the required overall risk-level is achieved also in 
the case that one system violates the lower level requirement. Through the definition 
of maximum permissible risk values for functions and systems an overstretching of 
risk balancing shall be avoided. 

Risk based design for ships and ship systems offer a higher flexibility to develop 
optimal solutions tailored for a specific task, and risk-based analysis and design is 
used in different industries. These applications demonstrate the advantages com- 
pared to traditional design and analysis. Further, appropriate methods required for 
risk-based design have been developed in these industries and can be adopted for 
the maritime industry. 

As we have previously discussed, the engineering costs will in most cases in- 
crease with risk-based design compared with the traditional design process. Thus, 
the discussions show that one major application of risk-based design will be the de- 
velopment of new system types outside a specific ship design. This process is then 
comparable to the “type approval process”. In this context the issue of direct dia- 
logue between supplier and approval authority, especially the flag state, was raised. 

Risk-based system design requires the definition and application of acceptance 
criteria. Acceptance criteria can be related to safety, the environment or to economic 
(reliability, availability) factors. Usually, only one of these risk categories gives the 
relevant design criterion and is the dimensioning criterion. However, the approval 
process is focused on safety and environmental criteria. The approval process and 
the acceptance criteria used should provide an objectivity and transparency to make 
the influence of the specific approval authority negligible. 
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Even if tentative risk acceptance criteria can be developed, presently available 
data are limited and only in special cases risk acceptance criteria can be deduced for 
ship systems from historical data. 


4.7 Operating a Risk-Based Approved Ship 


Two different perspectives can be distinguished when risk-based ship operation is 
being addressed. One is the operation of a risk-based designed ship and the other 
is the use of risk-based approaches in ship operation (as required by the ISM code 
already). The latter is a clear commercial issue; hence this chapter will be focused 
only on the operation of a risk-based ship Vergine and Borlenghi (2008). 

Operation of the risk-based ship is the logical next step after risk-based design 
and approval. Even though the operation, as such, is not a part of the construction, 
operational aspects need to be considered carefully e.g. how to deal with the port 
state control. 

As well as the operation of a risk-based designed ship is expected to be influenced 
by the design assumptions, at the same time the operational aspects have to be duly 
considered during the risk-based design phase. 

It will be essential that the risk designed ship of the future has very clear and 
concise records and instructions that identify the risks that were assessed (together 
with their justifications), and of what the actions and options have been exercised 
at the design stage so that the operators can manage the risks in the most effective 
fashion throughout the life of the vessel. 

Risk-based ships are already sailing and their operational aspects are aligned 
with the current regulatory framework treating risk-based elements as exemptions 
or equivalents today following SOLAS (2004), part a, reg. 4 or 5. 

In both cases, details and reasons for the acceptability are to be communicated 
to IMO and circulated to IMO Member States. However, each case is again a new 
case with the associated administrative requirements. In the case of the established 
possibility to implement alternative designs and arrangements following SOLAS I- 
2, reg.17, the relevant flag state administration is required to “communicate to the 
Organization pertinent information concerning alternative design and arrangements 
approved by them for circulation to all Contracting Governments.” With the advent 
of more design aspects of a ship becoming risk-based, there is a clear need to ensure 
proper information and documentation to facilitate smooth operations. 


4.7.1 On Board Documentation 


When operating a risk-based designed ship, inspections and surveys are some of 
the most important aspects to address. Every administration checking compliance 
will in the future, have to take into account possible risk-based elements of the ship. 
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A dedicated certificate to document risk-based elements on board would certainly 
help to convince less knowledgeable administrations and port state controls that the 
vessel in question is properly built and maintained. 

A good example is the documentation requirement in SOLAS II-2, reg.17.4.2 
stating “A copy of the documentation, as approved by the Administration, indicating 
that the alternative design and arrangements comply with this regulation shall be 
carried on board the ship.” 

The current discussion at IMO related to on board documentation is referred to 
the goal-based standards working group, where the so called “Ship Construction 
File” (SCF) is discussed. Such SCF will initially be carried on board the vessel 
throughout the lifetime of the vessel. 


4.7.2 The International Safety Management Code 


The ISM documentation is another instrument. The ISM-code (IMO 2002a/2005) 
requires to document a safety management system and to carry onboard all docu- 
mentation relevant to the particular ship. 

The ISM code requires the establishment of a safety management system with 
safety management objectives which lead to “safe practices in ship operation and a 
safe working environment,” and establishing “safeguards against all identified risks” 
(IMO 2002a/2005). 

Although there is no further explicit reference to this general requirement in the 
remainder of the ISM Code, risk assessment is essential for demonstrating com- 
pliance with most of its clauses. The ISM Code does not specify any particular 
approach to the management of risk, and it is for the company to choose appropriate 
methods. 

Risk-based ships have been analyzed during the design stage and hazards as well 
as risk control options have been identified. This constitutes a good part of the risk 
identification required by the ISM code. It is likely that, for a novel ship, all aspects 
of the operation will be addressed during the early design stage with risk-based 
approaches. Thus, including risk-based elements into the ISM-code provisions is 
simple: the risk assessment of the design stage is the ideal input for establishing the 
safety management system required by the ISM code. 

It also follows that a more formal guidance for identifying risks and establishing 
safeguards and safe practices would create a harmonized approach to set up the 
safety management system under the ISM code. 

Following from the above, it appears that a complete documentation of all risk- 
based elements of a ship together with the process and criteria of acceptance should 
be carried onboard. In addition, a proper summary addressing the concerns of sur- 
veyors and port state control officers has been drafted. 
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4.7.3 Inspection of the Risk-Based Ship 


The inspection of a risk-based ship may require special competences for class 
surveyors and flag state inspectors. Supported by appropriate documentation, see 
above, the risk-based elements of the ship will have to be understood prior to check- 
ing. Likely, special training related to risk assessment is also needed for the inspec- 
tors and surveyors. 

In the event that the initial assumptions that were made during design and ap- 
proval are changed (the operational area, the cargo etc), then it will be necessary to 
revaluate the risk levels and make necessary adjustments, however it is worth being 
aware of the potential pitfalls in the need for periodic reassessment. 

Today, SOLAS II.2, reg. 17.6, requires a reassessment and states that “re- 
evaluation due to change of conditions if the assumptions, and operational restric- 
tions that were stipulated in the alternative design and arrangements are changed, 
the engineering analysis shall be carried out under the changed condition and shall 
be approved by the Administration.” 

It is expected that a reassessment will also be required if the vessel changes flag 
and/or class. 

Inspection of a risk-based designed ship is required, as well as for traditional 
ships. Class survey, flag state inspection and port state control have to understand 
the risk-based nature of the ship. This understanding could be promoted by means 
of additions to existing certificates affected (quoting on the risk based feature affect- 
ing them). 

Consideration could alternatively be given to the issuance of a dedicated certifi- 
cate. Proper authoritative documentation has the advantage of providing an inspec- 
tor with evidence of the vessel being built and maintained in a satisfactory manner. 
Except from the certificate, most of the documentation requirements are already 
in place. 

When performing PSC, time is limited. Should the PSC inspector come across a 
feature (such as an asymmetrical distribution of lifeboats) which he is not familiar 
with, an easy means to access the information on such a feature should be available. 

A “PSC-file”, or excerpts from the vessel documentation to ascertain that any 
such feature is approved by the administration, including further relevant informa- 
tion could be a practical tool. 

With regards to PSC-inspections, the risk model and the detailed investigations 
will not need to be demonstrated to the officials of the port state. Even if “all rele- 
vant documentation” related to the operation of the vessel will have to be on board, 
this is interpreted as all documentation of immediate relevance for the operation of 
the vessel, and technical source documents are usually not being perused by PSC- 
inspectors. 
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4.7.4 Owner’s Inspection 


Like in many other industries the responsibility lies at the owner to ensure that the 
information kept on board is correct. 

The primary goal of the Owner’s inspection is to verify and ensure the safe oper- 
ations of a risk-based ship relating to current shipboard conditions, and that the ship 
will pass Flag, Class, Port-state and other inspections. 

Owner’s inspections may consist of Management/Superintendent visit to the 
ship, or take place during annual internal company shipboard audits. 

Management should verify that the initial assumptions made during design and 
approval process have not changed (i.e. the route, the ship arrangement, capacity, 
non-statutory required outfitting, etc) as it will be necessary to re-evaluate the risk 
levels and make any adjustments required to reflect this change. Levels of spares, 
consumables and outfitting should also be checked. Any changes compromising 
risk related design features and operational procedures should be identified, and 
necessary corrective actions addressed. 

The inspection should include a review of onboard documentation, including the 
Ship Construction File (SCF) to ensure that it is current and being kept up-to-date. 
Additionally, management should verify that a complete set of risk documentation 
is carried onboard detailing all risk-based elements of the ship, the process and 
criteria of acceptance, and that this information is included in a summary to address 
any concerns of attending surveyors and port state control officers. 

Management must also confirm that the Officers and Crew onboard are aware of 
the risk based design and operational features the ship which should be detailed in 
the Safety Management System, and verify that they have undergone appropriate 
training to ensure that these features are not compromised. 


4.8 Conclusions 


A consistent Approval process is urgently needed to ensure a unified assessment of 
novel ship designs. 

Obviously, further examination into the nature of the presently applied approach 
may be highly beneficial, and is at present taking place. It may, though, be deducted 
from the statements in the previous chapters as well as from case stories, that the 
presently applied traditional approval methods may well, at least to a considerable 
extent, be interfaced with alternative methods of verification and approval. As it is, 
queries related to the offshore sector (where the Administration is mainly involved 
with life saving appliances) take into consideration the safety cases submitted by 
the applicant, which apply risk based assessments of safety levels. 

Summing up, there is potential for elaboration on the concept, to allow a glance 
at what Administrations may in the future be faced with, as well as possible ways 
of expanding the existing methods associated to the Approval process. 
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The development within the SAFEDOR project concerning the approval process 
will be submitted to the IMO in a comprehensive extract of our work. 
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Chapter 5 
Methods and Tools 


Jgrgen Jensen, Carlos Guedes Soares and Apostolos Papanikolaou 


Abstract Risk-based ship design demands advanced tools to accomplish the safety 
assessment of a given design. In this chapter, the background theory for the devel- 
opment and examples of application of related risk-based tools and of assessment 
procedures will be given. These tools and methods facilitate the analysis of the initi- 
ation and of the consequences of a variety of hazards, like system failure, collision, 
grounding, structural failure, fire, flooding and loss of intact stability. Finally tools 
for the simulation and analysis of evacuation, mustering & rescue procedures will 
be presented. 


5.1 Introduction 


Risk-based ship design demands advanced tools to accomplish the safety assessment 
of a given design. Such tools have been developed or refined in the course of the 
SAFEDOR project covering 


Assessment and analysis of system failures 

Fast and accurate prediction of flooding 

Probabilistic assessment of the strength of ship structures 
Probabilistic assessment of intact stability 

Prevention of collision and grounding events 

Prevention of fire and explosion events 


Various theoretical methods and procedures have been used to derive these tools: 
Bayesian network, artificial neural networks, CFD calculations, non-linear time 
domain calculations and reliability models, virtual reality models and simulation 
techniques. The results are validated by physical model tests and numerical simula- 
tions; where possible, simplified models enabling fast calculations are derived and 
calibrated. The developed procedures have been applied to a variety of case studies 
and ship types including container ships, RoRo ships, tankers and cruise vessels. The 
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ultimate goal is to provide the ship designer with tools and procedures for fast and 
reliable evaluation of various risks associated with failure of the ship or its subsys- 
tems and able to evaluate the effect of various risk-control options on ship design and 
operation. 

An overview of the risk-based design concept advanced by SAFEDOR and 
herein adopted is given next. 


“All criteria 
ful 


filled 2 


ye 
Probability X > 


Consequences Risk 


The following chapter addresses a series of the above risk drivers, their conse- 
quences and remedial actions. 

The first section deals with system failure as this type of failure is often the 
initiation event for large-scale damages. The section focuses on a semi-automatic 
tool for the generation and analysis of fault and event trees; it also addresses the 
optimization of system for increased reliability and safety. 

The topic for the next section is collision and grounding events. These events are 
treated together as the tools described have strong similarities. The main tools are 
Bayesian Networks able to estimate the probability of these events. Also Artificial 
Networks are discussed for fast prediction of collision and grounding damages. 

As a natural follow-up, structural failure is considered in the following section. 
An overview of structural reliability is given, dealing with structural strength as well 
as hull girder loads, and examples related to structural failure of damaged vessels 
are given. 

Following a structural failure flooding might take place and methods/software 
tools able to estimate the flooding process and its consequences (damage ship 
stability, capsize and foundering) are reviewed. This topic is a quite complex area 
in which significant research effort is currently devoted; results appear in some 
cases not yet mature enough to be routinely used in the actual design 
of ships. 
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Another serious type of accident that can occur to a vessel is fire and explosions. 
Computational Fluid Dynamics (CFD) is able to predict the development of a local 
fire under rather limiting conditions. However, it represents a promising tool for 
future developments and some results are presented in the section. 

Not all damages to a vessel need an initiating accident as a collision, grounding 
and fire. Wave loads and specific ship and environmental conditions can under cer- 
tain circumstances lead to excessive roll angles of the intact vessel. Thereby, loss of 
or damage to cargo might occur and even capsize (loss of intact stability, paramet- 
ric roll) could happen. This is especially so for large container vessels and hence 
of significant importance in the design of such vessels. Various methods and tools, 
which are employed to simulate these phenomena, are described; this includes an 
effective assessment procedure known from structural reliability, which is used to 
estimate the roll angle in a stochastic seaway. 

The final section deals with tools enabling the simulation of evacuation, 
mustering and rescue. The pertinent parameters are defined and three different 
software tools for analyzing mustering and evacuation are presented and discussed. 


5.2 System Failure 


Increasing complexity in the design of engineering systems onboard ship, especially 
those incorporating new programmable technologies, challenges the applicability 
of rule-based design or classical safety and reliability analysis techniques on new 
designs. As new technologies introduce complex failure modes, classical manual 
safety and reliability analysis of systems becomes increasingly more difficult and 
error prone. 

To address these difficulties, computerised tools are being developed that sim- 
plify aspects of the engineering and analysis process. Two such tools are described 
in the following. The first tool largely automates the synthesis of two types of pre- 
dictive model of system failure, Fault Trees and Failure Modes and Effects Analyses 
(FMEAs), by interpreting reusable specifications of component failure in the con- 
text of a system model. The analysis is largely automated and therefore reduces the 
effort required to examine safety, while the underlying algorithms can scale up to 
complex systems. The second tool extends the above concept to solve a design opti- 
misation problem that of reliability versus cost optimisation via selection and repli- 
cation of components and alternative sub-system architectures. The tool employs 
Genetic Algorithms to progressively evolve initial non-optimal designs to designs 
where components or alternative sub-systems with appropriate reliability character- 
istics have been selected and replicas have been allocated in a way that reliability 
requirements are achieved with minimal cost. 

This section outlines these two technologies and their application in an advanced 
and largely automated engineering process. 
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5.2.1 Introduction 


Fault Tree Analysis (FTA) and FMEA are well-known and widely used system anal- 
ysis techniques used in reliability engineering. Both are long established - FMEA 
was formally introduced in the late 1940s, and FTA has been around since the 
1960s — and both have been employed in a number of different areas, including the 
aerospace, nuclear power, and automotive industries. They are methods that we can 
use to identify potential faults in a system, so that we can then use that information 
to correct or prevent those faults. 

Fault Tree Analysis (FTA) is a flexible tool, equally applicable to quantitative 
and qualitative analyses, and easy to use and understand. Fault trees themselves are 
graphical representations of logical combinations of failures, and show the relation- 
ship between a failure or fault and the events that cause them. A fault tree normally 
consists of a top event, which is typically a system failure, connected to one or more 
basic events via a system of logical gates, such as AND and OR. Basic events are 
usually either failures or events expected to happen as part the normal operation 
of the system. Analysis of the fault tree consists of two parts: qualitative (logical) 
analysis, and quantitative (probabilistic) analysis. Qualitative analysis is done by 
reducing the logical expression represented by the fault tree into a set of minimal 
cut sets, which are the smallest possible combinations of failures required to cause 
the top event. Quantitative analysis is done by calculating the probability of the top 
event given the probability of each of the basic events occurring. 

In an FMEA, the basic process consists of compiling lists of possible component 
failure modes (which is a complete description of how an entity fails), gathered from 
descriptions of each part of the system, and then trying to infer the effects of those 
failures on the rest of the system. Usually, these effects are evaluated according to a 
number of criteria, such as: 


e Severity — how severe/critical is the impact on the rest of the system? 
e Probability — how likely is it that this failure mode will occur? 
e Detectability — how likely is it that this failure will be detected? 


These criteria are then combined into an overall priority figure for the effect of the 
failure mode, known as the Risk Priority Number (RPN), generally by multiplying 
the criteria together. All of this data is then presented in the form of a table, which 
allows the analyst to quickly see what the effects are of each failure mode. 

There are obvious differences between the two techniques. FTA is a deductive 
technique, which means it works from the top down — assuming the system has 
failed, and then trying to work out why it failed. This is done by working backwards 
trying to determine what possible combinations of events might have caused it; the 
system failure then becomes the top event of the fault tree and the individual com- 
ponent failures form the basic events, and they are all combined using a network 
of logical gates. FMEA, by contrast, is an inductive technique, and works from the 
bottom up — assuming a component failure has occurred, and then trying to work 
out what its effects would be. It involves proposing a certain event or condition, and 
then trying to assess the effects of that initial event on the rest of the system. The 
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end result is a table of failures and their effects on the system, which provide the 
analyst with an overview of the possible faults. 

Both techniques are useful and provide a lot of valuable information about sys- 
tems, and each can be used to complement the other, but both suffer from the same 
flaw: they are primarily manual methods. The process of performing these analyses 
can be laborious, especially for larger and more complex systems. Whilst this has 
the benefit of providing the analyst with an in-depth knowledge of the system being 
studied, it can also more likely be that the analyst will make a mistake, or that the 
results (once obtained) are too numerous to interpret efficiently. As a result, it is not 
uncommon for FTA and FMEA to take place only once or twice in the life cycle 
of the system. This is unfortunate, because systems analysis techniques like FTA 
and FMEA can be of great benefit during an iterative design process. By estimating 
the reliability and gaining a more thorough understanding of the failure behaviour 
of the system in each iteration, it is be possible to see how the changes in design 
impact upon the overall safety of the system. It also enables the analysts to identify 
and remedy potential flaws much earlier, thereby saving both time and effort and 
producing a more reliable product. 

However, before FTA or FMEA can be incorporated into the design cycle in this 
way, it is necessary to overcome the problems inherent in such manual techniques. 
Experience from the aerospace and process industries suggests that the application 
of classical safety analysis is hindered by the increasing complexity of systems. 
For relatively simple systems, this is a manageable process, although fault trees and 
FMEAs can rapidly become very elaborate. In complex systems, however, manual 
analysis becomes laborious and error prone, and a thorough assessment and inter- 
pretation of the results become increasingly more difficult to achieve within the 
realistic constraints of most projects. 

While guidance is given on how technical justification for alternative designs 
and arrangements can be provided in the form of engineering and safety analyses, 
such as fault tree analysis (FTA) and FMEA, there is a need for specific supporting 
measures and tools to assist in the application of such techniques. One obvious 
approach would be to automate them in some way, or at least enable parts of the 
process to be carried out in an automated fashion. This would mean that the analysis 
could be carried out more quickly and efficiently, leaving more time for the results 
to be studied and allowing more useful conclusions to be drawn. 

HiP-HOPS (Hierarchically Performed Hazard Origin and Propagation Studies) is 
a new technique for the semi-automatic construction of fault trees and FMEAs, de- 
veloped at the University of Hull, intended to achieve such a goal. In this technique 
fault trees and FMEA are automatically constructed from topological models of the 
system that have been augmented with appropriate component failure data. To re- 
alise the potential for useful automation offered by HiP-HOPS, an implementation 
that extends the capabilities of Simulation X, a modelling and simulation tool au- 
thored by ITI GmBH, has been developed with new capabilities for automatic safety 
and reliability analysis. We should note that these capabilities are unique among 
simulation tools. It is anticipated that with this extension Simulation X could in the 
near future facilitate the useful integration of a largely automated and simplified 
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form of safety and reliability analysis in the context of an improved design process. 
This in turn should contribute to addressing the broader issue of how to make safety 
amore controlled facet of the design so as to enable early detection of potential haz- 
ards and direct the design of preventative measures. The utilization of the approach 
and tools has been shown to be beneficial in cases studies on engineering systems 
in the shipping (Uhlig et al. 2007) and offshore industries (Hamann et al. 2008). 
A brief description of the analysis methodology in HiP-HOPS and the developed 
computerised tools follows. 


5.2.2 Overview of Methodology 


A HiP-HOPS study of a system under design has three phases: 


e System modelling and failure annotation, 
e Fault tree synthesis and 
e FMEA synthesis. 


The first phase is executed manually while the latter two phases are fully auto- 
mated. 

The first phase consists of developing a model of the system (hydraulic, electri- 
cal or electronic, mechanical systems, and conceptual block and data flow diagrams) 
and then annotating components in that model with failure data. In this phase, mod- 
elling can be carried out in Simulation X as it would normally have been carried out 
for the purposes of simulation. Failure annotations are added to components of the 
model using a developed graphical user interface (GUI). 

The second phase is the fault tree synthesis process. In this phase, an automated 
algorithm is applied to the annotated system model to create a set of fault trees which 
define system failures and their causes in the architecture. The algorithm works by 
taking failures of system outputs and progressively working backwards through the 
model to determine which components caused those failures. System failures and 
component failures are then joined together using the appropriate logical operators 
to construct fault trees with the failures at the system outputs as the top events and 
the root causes as basic events. The concept is illustrated in Fig. 5.1. 

In the third phase, fault trees are analysed and an FMEA is constructed which 
combines all the information stored in individual fault trees. The FMEA is presented 
in the form of a table listing, for each component, the effects of each component fail- 
ure on the system. As part of this process, both qualitative (logical) and quantitative 
(numerical-probabilistic) analyses are carried out on the fault trees. These analyses 
provide both the minimal cut sets of each fault tree and the unavailability (i.e. failure 
probability) of top events. 
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Fig. 5.1 The synthesis of fault trees from the system model 


5.2.3 Modeling Phase 


HiP-HOP studies can be performed on any model of a system that identifies compo- 
nents and the material, energy or data transactions among components. In practice, 
such models can be developed in Simulation X and can be hierarchically arranged, 
to manage complexity, if necessary. The basic idea of HiP-HOP is that an output 
failure of a component can either be caused by an input failure, an internal failure, 
or some combination of both. The local component output deviations and topol- 
ogy information are used to determine the relation between local deviations and top 
events. 

For the purpose of the analysis, each component in the model must have its own 
local failure data, which describes how the component itself fails and how it re- 
sponds to failures propagated by other components in the vicinity. Essentially, this 
information specifies the local effects that internally generated or propagated fail- 
ures have on the component’s outputs. This is achieved by annotating the model 
with a set of failure expressions showing how deviations in the component outputs 
(output deviations) can be caused either by internal failures of that component or 
corresponding deviations in the component’s inputs. Such deviations include un- 
expected omission of output or unintended commission of output, or more subtle 
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failures such as incorrect output values or the output being too early or late. This 
logical information explains all possible deviations of all outputs of a component, 
and so provides a description of how that component fails and reacts to failures else- 
where. At the same time, numerical data can be entered for the component, detailing 
the probability of internal failures occurring and the severity of output deviations. 
This data will then be used during the analysis phase to arrive at a figure for the un- 
availability of each top event. Once done, the component can then be stored together 
with the failure data in a library, so that other components of the same type can use 
the same failure data or this type of component can be re-used in other models with 
the same failure data. This avoids the designer having to enter the same information 
many times. 

For the specification of the components’ failure modes (which are the effects by 
which the component failures are observed), a generic and abstract language was 
developed. There are different ways of classifying failure modes, e.g. by relating 
them to the function of the component, or by classifying according to the degree 
of failure — complete, partial, intermittent etc. (Rausand and Oien 1996) In general, 
however, the failure of a component will have adverse local effects on the outputs 
of the component which, in turn, may cause further effects travelling though the 
system on material, energy or data exchanged with other components. Therefore 
in HiP-HOPS, we generally classify the effects into one of three main classes of 
failure, all equally applicable to material, energy or data outputs. These are, namely, 
the omission of an output, i.e. the failure to provide the output, a commission of 
an output, i.e. a condition in which the output is provided inadvertently and in the 
wrong context of operation, and an output malfunction, a general condition in which 
the output is provided but at a level which deviates from the design intention. Since 
this classification adopts a functional viewpoint which is independent of technology, 
it could provide a common basis for describing component failures and their local 
effects. However, HiP-HOPS can work with any classification of failure modes as 
long as it is consistent from one component to the next. 

Components do not only cause failures, but they also detect and respond to fail- 
ures caused by other components or transfer failures of other components. However, 
components do not only generate, mitigate or propagate failures. They may also 
transform input failures to different types of output failure. For instance, a controller 
may be designed to respond to detected sensor failures by omitting any further out- 
put to ensure that hazardous control action is avoided. In this case, malfunctions at 
the input are intentionally being transformed into omission failures. To capture those 
general patterns of behaviour of a component in the failure domain, we propose a 
technique that can be used to systematically examine the generation, propagation 
and transformation or mitigation of failure across the component input and output 
interface. In the proposed technique, manual analysis is performed at component 
level and focuses on the output ports through which a component provides services 
to other components in the system. In the course of the analysis, each output port is 
systematically examined for potential deviations of parameters of the port from the 
intended normal behaviour, which generally fall into the following three classes of 
failure: 
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a) Omission: failure to provide the intended output at the given port 
b) Commission: unintended provision of output 
c) Malfunction: output provided, but not according to design intention. 


Within the general class of malfunctions, analysts may decide to examine more 
specific deviations of the given output which, in most applications, will include con- 
ditions such as the output being delivered at a higher or lower level, or earlier or later 
than expected. As an example, Fig. 5.2 shows the analysis of a two-way computer 
controlled valve. The figure shows the valve as it would typically be illustrated in a 
plant diagram and records the results of the local safety analysis of the component 
in two tables that define valve malfunctions and output deviations respectively. 

In normal operation, the valve is normally closed and opens only when the com- 
puter control signal has a continuously maintained value of a logical one. Valve mal- 
functions include mechanical failures such as the valve being stuckOpen or stuck- 
Closed, and blockages caused by debris such as blocked and partiallyblocked. For 
each malfunction, the analysis records an estimated failure rate while the effects of 
those malfunctions on the output of the valve can be seen in a second table that lists 
output deviations. 

This specification of failure modes is generic in the sense that it does not contain 
references to the context within which the valve operates. Failure expressions make 
references only to component malfunctions and input/output ports of the compo- 
nent. The failure behaviour described in these expressions has been derived assum- 
ing a simple operation that we expect the component to perform in every application 
(valve is normally closed unless the value of control signal is 1). For these reasons, 
the specification of Fig. 5.2 provides a template that could be re-used in different 
models and contexts of operation, perhaps with some modifications, e.g. on failure 
rates, to reflect a different environment. 


control 
Valve Malfunctions 
Failure mode Description Failure rate 
blocked e.g. by debris le-6 
partially Blocked e.g. by debris Se-5 
stuckClosed Mechanically stuck 1.5e-6 
stuckOpen Mechanically stuck 1.5e-5 


Deviations of Flow at Valve Output 


Output Description Causes 
Deviation 
Omission-b Omission of blocked OR stuckClosed 
flow OR Omission-a OR Low-control 
Commission-b Commission stuckOpen OR Commission-a 
of flow OR Hi-control 
Low-b Low flow partiallyBlocked OR Low-a 


Fig. 5.2 Failure annotations of a computer-operated two-way valve 
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5.2.4 Synthesis Phase 


As it was seen in Fig. 5.2, component failure data relate output deviations to logi- 
cal expressions that describe the causes of those deviations as component malfunc- 
tions and deviations of the component inputs. Each such expression is effectively 
a mini fault tree which links a top event (the output deviation) to leaf nodes, some 
of which may represent input deviations. When we examine a component out of 
system context, input and output deviations represent only potential conditions of 
failure. However, when we place the component in a model of a system, the input 
deviations specified in the analysis can actually be triggered by other components 
further upstream in the model and the specified output deviations can similarly cause 
more failures further downstream. 

This mechanism by which output failures of a particular class at one end of a 
connection trigger input failures of the same class at the other end results in a global 
propagation of failures through the system which may ultimately cause significant 
hazardous failures at the outputs of the system. Given a model of the system and the 
local safety analyses of its components, it is possible to capture this global propaga- 
tion of failure in a set of fault trees. These fault trees are mechanically constructed 
by traversing the model and by following the propagation of failure backwards from 
the final elements of the design (e.g. electromechanical actuators) towards the sys- 
tem inputs (e.g. material/energy resources, operators and data sensors). The fault 
tree is generated incrementally, as we parse the local safety analyses of the com- 
ponents encountered during the traversal, by progressively substituting the input 
deviations for each component with the corresponding output failures propagated 
by other components. Figure 5.3 illustrates the principle that underpins this process 
of fault tree synthesis. The figure shows a hypothetical motor and its starter circuit 
as a unit (M) that transforms electrical power provided by a power supply (PS) to 
mechanical power on a rotating axis. 

The motor starter receives normal start and stop commands from a control com- 
puter (Controller). As a safety feature the controller is also connected to a sensor 


electPower 


start loadMeas 


mechPower 


Component | Output Deviation | Description Causes 
M OE-mechPower Omission of mechanical motorFailed OR OE-electPower OR 
power OS-start OR CS-stop 


[PSs [ OE -electPower Omission of electrical power | powerSupplyFailed 
F controler | OS-sart | Omission of star signal | conolerFailed 


e— CS-stop Commission of stop signal elecMagnInterference OR HV-loadMeas 


HV-loadMeas Hi value in load measurement | sensorBiased 


Fig. 5.3 Example system and fragments of local safety analyses 
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(LS) that monitors the load connected to the axis of the motor and when the mea- 
surement exceeds a specified load it issues a stop command to protect the motor. 
To illustrate the fault tree synthesis, the figure also provides a table that contains, 
for simplicity, only fragments from the local analyses of the Motor, the Power Sup- 
ply, the Controller and the Load Sensor. For simplicity, deviations in this table refer 
to names of connections in the model rather than local names of component ports. 
Collectively, these deviations and their causes define the propagation of failures that 
result in an omission of mechanical power at the output of the motor. 

The local analysis of the motor, for example, defines that this event can be caused 
by a failure of the motor, an omission of electrical power at the input, an omission 
of the start signal or, interestingly, a commission of the stop signal. The causes of 
some of those events can in turn be explored further in the local analyses of the 
components connected to the motor. For example, the analysis of the power supply 
defines that a failure of this component will cause an omission of electrical power. In 
turn, the analysis of the controller defines that an omission of the start signal will be 
caused by a controller failure while a commission of the stop signal can be caused 
by electromagnetic interference or in response to an abnormally high measurement 
of motor load. The analysis of the load sensor defines that the latter is indeed a 
plausible failure mode that can be caused in normal conditions of loading if the 
sensor is positively biased. 

An overall view of the global propagation of failure in the system can be automat- 
ically captured by traversing the model and by following the causal links specified in 
the local safety analyses of the components that we progressively encounter during 
this traversal. The result of this process for the above example is the fault tree that 
is illustrated in Fig. 5.4. Note that this mechanically synthesised fault tree records 
the propagation of failure in a very strict and methodical way. It starts from an out- 
put failure, the omission of mechanical power, and following dependencies between 
components in the model it systematically records other component failures that 
progressively contribute to this event. The logical structure of the tree is determined 


OE-mechPower 


OE-elecPower 


powerSupplyFailed 


Fig. 5.4 Mechanically constructed fault tree for the example system 
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only by interconnections between the components and the local analyses of those 
components. This logical structure is straightforward and can be easily understood, 
unlike the structure of many manually constructed fault trees which is often defined 
by implicit assumptions made by analysts. Note that although in this example the 
tree only incorporates OR gates, other logical symbols such as AND and priority 
AND gates would appear in the tree structure if such relationships were originally 
specified in some of the local analyses. 


5.2.5 Analysis Phase 


In the final phase, the synthesised system fault trees are analysed, both qualitatively 
and quantitatively, and from these results the FMEA is created. Firstly, the fault 
trees undergo qualitative analysis to obtain their minimal cut sets, which reduces 
them in size and complexity. This is done using a mixture of classical logical re- 
duction techniques, which usually means applying logical rules to reduce complex 
expressions, and more modern techniques, such as the use of Binary Decision Di- 
agrams (BDDs), (Papadopoulos et al. 2001), to break down the tree into a simpler 
form. BDDs are graphs that represent the paths of failures through the fault tree, 
and are much faster and more efficient than classical methods, but unfortunately 
they cannot be used in all situations. Once the minimal cut sets have been obtained, 
they are analysed quantitatively, which produces unavailability values for the top 
events of each fault tree. 

The last step is to combine all of the data produced into an FMEA, which is a 
table that concisely illustrates the results. The FMEA shows the direct relationships 
between component failures and system failures, and so it is possible to see both 
how a failure for a given component affects everything else in the system and also 
how likely that failure is. However, a classical FMEA only shows the direct effects of 
single failure modes on the system, but because of the way this FMEA is generated 
from a series of fault trees, the FTS tool is not restricted in the same way, and the 
FMEAs produced also show what the further effects of a failure mode are; these 
are the effects that the failure has on the system when it occurs in conjunction with 
other failure modes. Figure 5.5 shows this concept. 

In Fig. 5.5, Fl and F2 are system failures, and C1—C9 are component failures. 
For C3, C4, C6 and C7, there are no direct effects on the system — that is, if only 
one of these components fail, nothing happens. However, they do have further ef- 
fects; for example, C3 and C4 both occurring in conjunction will cause F1 to occur. 
The FMEAs produced, then, show all of the effects on the system, either singly or 
in combination, of a particular component failure mode. This is especially useful 
because it allows the designer to identify failure modes that contribute to multiple 
system failures (e.g. C5 in the example of Fig. 5.5). These common cause failures 
represent especially vulnerable points in the system, and are prime candidates for 
redundancy or extra reliable components. 


5 Methods and Tools 207 


Network of Interconnected System Fault Trees 


F1 F2 


S 


Ci C2 C3 C4 C5 C6 C7 C8 C9 


FMEA synthesis algorithm 


Multiple Failure System FMEA 


Component Direct Effects caused in 

failure effects on conjunction with 
the system (other events) 

C1 F1 - 

C2 F1 - 

C3 - F1 (C4) 

C4 - F1 (C3) 

C5 F1,F2 - 

C6 - F1,F2 (C7) 

C7 - F1,F2 (C6) 

C8 F2 7 

cg F2 - 


Fig. 5.5 The conversion of fault trees to FMEA 


5.2.6 Optimisation Phase 


HiP-HOPS analysis may show that safety, reliability and cost requirements have 
been met in which case the proposed system design can be realised. In practice, 
though, this analysis will often indicate that certain requirements cannot be met in 
which case the design will need to be revisited. This indeed is a problem commonly 
encountered in the design of reliable or critical systems. Designers of such sys- 
tems usually have to achieve certain levels of safety and reliability while working 
within certain cost constraints. Design of course is a creative exercise that relies on 
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the technical skills of the design team but also on experience and successful ear- 
lier projects. So the bulk of design work is creative. However, we believe that some 
further automation can assist the decision on the selection among alternative com- 
ponents or sub-system designs as well as on the level of replication of components 
in the model that is required to ensure that the system ultimately meets its set safety 
and reliability requirements with minimal cast. 

A high degree of reliability and safety can often be achieved by using a more re- 
liable and expensive component, an alternative sub-system design or by using repli- 
cated components or subsystems to ensure that functions are still provided when 
components or subsystems fail. In a typical design though, there are many options 
for substitution and replication at different places in the system and different levels 
of the design (component/subsystem). It may be possible for example to achieve 
the same reliability by substituting two sensors here and three actuators there, or by 
replicating a single controller, a control subsystem etc. Different solutions however 
will lead to different additional costs, and the question here is which is the optimal 
solution; it could be one for example that achieves a certain degree of reliability and 
safety with the minimum additional cost. Because the design options for replication 
in a non-trivial design are typically too many to consider it is virtually impossible 
for designers to address the above questions systematically, so people rely on intu- 
ition, or on evaluation of a few different design options. Some automation in that 
area would therefore be useful to designers in area. 

In the present approach, this has been achieved by combining work on HiP-HOPS 
with recent advances in design optimisation (Papadopoulos and Grante 2005). 
More specifically, a tool that employs genetic algorithms in order to progressively 
“evolve” an initial design model has been developed which does not meet require- 
ments to a design where components and sub-system architectures have been se- 
lected and where replicas have been allocated in a way that minimizes cost while 
achieving given safety and reliability requirements. In the course of the evolutionary 
process, the genetic algorithm typically generates populations of candidate designs 
which employ user-defined alternative implementations for components and subsys- 
tems as well as standard replication strategies. These strategies are based on widely 
used fault tolerant schemes such as hot or cold standbys and n-modular redundancy 
with majority voting. For the algorithm to progress towards an optimal solution, a 
selection process is applied in which the fittest designs survive and their genetic 
make up is passed to the next generation of candidate designs. The fitness of each 
design relies on cost and reliability. To calculate fitness, therefore, we need ways in 
which to automatically calculate those two elements. An indication of the cost of 
a system can be calculated as the sum of the costs of its components (although for 
more accurate calculations life-cycle costs should also be taken into account such as 
production, assembly and maintenance costs) (Grante and Andersson 2003). How- 
ever, while calculation of cost is relatively easy to automate, the automation of the 
evaluation of safety or reliability is more difficult as conventional methods rely on 
manual construction of the reliability model (e.g. the fault tree, reliability block 
diagram or the FMEA). HiP-HOPS, though, automates the development and calcu- 
lation of the reliability model, and therefore facilitates the evaluation of fitness as a 
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function of reliability (or safety). This in turn enables a selection process through 
which the genetic algorithm can progress towards an optimal solution which can 
guarantee the required safety and reliability at minimal cost. 


5.2.7 Tool Support 


To enable application of the above concepts in engineering design, a prototype im- 
plementation of HiP-HOPS has been developed that extends the capabilities of Sim- 
ulation X with new capabilities for automatic safety and reliability analysis. The 
architecture of this extension is illustrated in Fig. 5.6. 

Simulation X provides a Graphical User Interface (GUI) that enables annotation 
of components in the model with the failure modes and failure expressions required 
for the fault tree and FMEA synthesis. These data become part of the model and are 
automatically saved and retrieved by SimulationX. Failure annotations are stored 
together with a component in component libraries and can be re-used either directly 
or following modifications within the same model or across different models with 
the obvious benefit of simplifying the manual part of the analysis. The second com- 
ponent of the tool is a parser that interprets an output file produced by SimulationX, 
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Fig. 5.6 Architecture of the automated safety analysis and optimization tool 
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and reconstructs the enclosed annotated models for the purposes of fault tree syn- 
thesis. The synthesis itself is performed by the third component of the tool, the 
fault tree synthesis algorithm. The resultant network of fault trees is then logically 
reduced into minimal cut-sets. Finally, an FMEA synthesis algorithm operates on 
these cut-sets, and in a single traversal of the cut-sets generates two FMEA tables. 
The first table is a single failure mode FMEA which shows, for each failure mode 
of each component in the system, the direct effects on the system. Further effects 
caused by conjunctions of component failure modes are shown in a second table 
which presents a lengthier and more detailed multiple failure mode FMEA analysis. 
In the current implementation of the algorithm, the synthesis of the FMEA is sepa- 
rated from the display of tables. Indeed, an FMEA store is first created in memory 
and then an HTML generator is used to parse this store and create web pages con- 
taining the tables of data. The advantages of this medium include easy distribution 
and display and the ability, through hyperlinks, to navigate different aspects of the 
information. 

The tool is designed to recognise and handle loops in the model that create circu- 
lar references to the same failure logic in fault trees (e.g. conditions such as: event 
A is caused by event B which in turn is caused by event A). When such circles are 
encountered, the failure logic contained in the circle is only incorporated once in 
the trees. At the same time, a note is made and the analyst is invited to think what 
happens in the steady state where it is always possible to decide what is the final 
effect to an output of an initiating fault further upstream. 

To manage complex hierarchical models effectively, the synthesis algorithm was 
designed to perform traversals both across the vertical and horizontal axis of the 
design hierarchy. Indeed, the current implementation allows the annotation of hier- 
archical structures at all levels of the design. If, for example, a subsystem as a whole 
is susceptible to a failure mode, then the effect of this condition can be directly speci- 
fied with a failure annotation at subsystem level. This annotation, for example, could 
define that all outputs of the subsystem are omitted in the event of the global dis- 
turbance. Such annotations would typically complement other annotations made at 
the level of the enclosed components to describe aspects of failure behaviour at this 
level (e.g. the mechanical and electrical failure modes of each component). In gen- 
eral, when examining the causes of a failure at an output of a sub-system, the fault 
tree synthesis algorithm creates a disjunction between any failure logic specified at 
sub-system level and logic arising from the enclosed lower levels. 

The HiP-HOPS tool has also been extended with capabilities for reliability ver- 
sus cost optimisation as these were described in Sect. 5.2.6. Optimization has been 
applied to a number of known benchmark problems with results that represent im- 
provement to those reported in earlier works (Parker and Papadopoulos 2007). How- 
ever, despite initial successes, it is still premature to comment on performance or 
make credible comparisons with earlier work, at least in terms of speed and scalabil- 
ity. However, we can identify at this point a few conceptual differences between our 
approach and earlier work. Earlier approaches to architectural optimisation, (Coit 
and Smith 1996, Deb 1999, Grunske 2006) for example, calculate reliability from 
manually constructed Reliability Block Diagrams in which systems are formed as a 
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series-parallel configuration of components and it is assumed components and the 
system itself “work” or “fail” in a single failure mode which typically represents a 
complete loss of function. 

The difference between the proposed approach and this earlier work is that, in 
our approach, the safety and reliability model (i.e. a set of automatically derived 
system fault trees) is not generated simply from the topology of the system, but 
from an engineering model which also includes information about the failure be- 
haviour of components. In this model, components do not need to be in series- 
parallel configurations. The model for example may include bridges between par- 
allel paths, hierarchically nested series and parallel connections as well as complex 
dependencies caused by control loops. Perhaps a more significant departure from 
earlier work is that the present basic failure assumption goes beyond the classical 
“success-failure” model. Indeed, in the present approach, components can exhibit 
more than one failure modes which include the “loss” but also the “commission” of 
functions as well as “value” and “timing” failures. These more realistic failure as- 
sumptions should help to improve the quality of the solutions reached by this type of 
analysis. 
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5.3 Collisions and Groundings 


5.3.1 Introduction 


The focus is herein on two aspects; (1) events that lead to a collision or grounding, 
(2) damage to the ship after a collision or grounding. 

For addressing the first part two Bayesian networks are set up. These describe the 
interdependencies and joint probabilities in chain of events that lead to a collision 
or grounding. The input is a given scenario: traffic intensity, area complexity, bridge 
layout etc. and the output is then the probability that the ship will have a collision. 
The networks seem to give good qualitative results but the absolute probabilities of 
collision or grounding seem slightly too high. 

The second part calls for an artificial neural network, which is trained with a 
large number of collision cases and thereby is able to predict new collision cases. 
The network estimates the training data very well. When estimating the collision 
penetration for ships not used for training the results are a bit more ambiguous. 
But for collision speeds in the range 0-12 knots the results are reasonable. Finally, 
a similar network to predict the damage after grounding was also developed and 
implemented. 


5.3.2 Risk Model for Obtaining the Causation Probability 


This section discusses how to model the chain of events that leads to a ship collision 
or grounding. It suggests using Bayesian network instead of the traditional event- 
trees. A simple Bayesian network for calculating the collision probability of two 
ships is presented. The result is compared to observed values of the causation fac- 
tor. A more detailed approach for collision and grounding is sketched. The results 
of these more detailed models are not very satisfactory. One reason being, that they 
need a lot of knowledge about the causal relationships between the different vari- 
ables. However the models behave qualitatively as expected. Meaning they increase 
or decrease the probability of an event when variables like weather or navigational 
aids are changed. 

It is virtually impossible to formulate a full risk analysis that properly takes all 
relevant aspects into account. The modelling should, however, account for a sub- 
set as large as possible of the potential error mechanisms. This section describes 
the traditional risk analytical approach for obtaining the causation probability. We 
discuss the drawbacks of the traditional formulation and suggest applying Bayesian 
Networks for the analysis. The subsequent section describes aspects that should be 
considered in the modelling. 
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5.3.2.1 Traditional Approach 


The traditional approach for calculation of the causation probability P, (i.e. analysing 
the cause leading to human inaction or external failures) is to formulate a fault tree 
or an event tree analysis, see Haugen (1991), as shown in Fig. 5.7. 

From this fault tree it is found that the causation probability P. can be ex- 


pressed as 
Poe =X4+(1—X4) X01 Xa (5.1) 


where 


Xa is the probability of human failure 

Xc, is the probability of radar failure, which will depend on vessel size, age, 
nationality, etc. 

Xc2 is the fraction of the year with low visibility. 


Causation 
Probability: 
Py =5.5E-4 


Radar failure 
in bad visibility 


Human failure 
in good visibility 


Human or radar 
failure 


Human Bad 
visibility 


visibility failure 


Human Radar 
failure failure 


Distracted Accident Asleep Alcohol 


Fig. 5.7 Fault tree for causation probability P. for collision against fixed object 
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By application of such fault tree analyses for estimation of the causation prob- 
ability, it is possible to examine the beneficial effect of new bridge procedures, of 
having a pilot on board, or of introducing a VTS system in certain geographical ar- 
eas. Olsen et al. (1992) studied the effect of a VTS system by an event tree analysis. 

When inspecting the above fault tree it is questionable whether the modelling ac- 
tually captures any of the important failure mechanisms relevant for the considered 
critical situation. Factors that relate to navigational complications are not included 
in the analysis, although these are of importance for the relevant set of human er- 
rors. Moreover, it is seen that human failure contributes with 75% (2.6-10~*) to 
the causation probability. The dominance of the human failure is in agreement with 
observations. However, the “Asleep” node is the dominant contributor (2.0- 10~*) 
and it accounts for 60% of the causation probability. Although the dominating cause 
may be attributed to human errors this does not seem to be correct as high vigilance 
is expected in confined navigational areas. An important concern of the fault tree 
modelling is that the human factor model does not properly capture the relevant 
tasks that must be considered in the analysed critical situation. 


5.3.2.2 Using Bayesian Networks 


Most practical risk analysis problems are characterised by a large set of interrelated 
uncertain quantities and alternatives. Within the conventional risk analysis different 
methods such as fault tree analysis and event tree analysis have been developed to 
address these problems. A fault tree analysis seeks the causes of a given event, and 
an event tree analysis seeks the consequences of a given event. The two analysis 
techniques are supplementary methods, and when applied correctly the formulated 
model may reveal the entire probability structure of the model. Both fault tree analy- 
sis and event tree analysis — applied separately and combined — have in the past with 
success been used in the evaluation of the risk of various hazardous activities. Un- 
fortunately, both fault tree and event tree analyses do have their drawbacks. Firstly, 
it is difficult to include conditional dependencies and mutually exclusive events in a 
fault tree analysis (a conditional dependency is, for example, the dependence of the 
visibility on the weather; mutually exclusive events are, for example, good weather 
and storm). If conditional dependencies and mutually exclusive events are included 
in a fault tree analysis the implementation and the pursuing analysis must be per- 
formed with utmost care. Secondly, the size of an event tree increases exponentially 
with the number of variables. Thirdly, if the analysis should capture the primary 
failure mechanism, the global model, which is combined fault trees and event trees, 
generally becomes so big that it is virtually impossible for third parties (and some- 
times even for first parties) to validate the model. 

Here we advocate the use of Bayesian Networks as the proper risk modelling 
and analysis tool. A Bayesian Network is a graphical representation of uncertain 
quantities (and decisions) that explicitly reveals the probabilistic dependence be- 
tween the set of variables and the flow of information in the model. A Bayesian 
Network is designed as a knowledge representation of the considered problem and 
may therefore be considered as the proper vehicle to bridge the gap between analysis 
and formulation. 
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A Bayesian Network is a network with directed arcs and no cycles. The nodes 
(to which the arcs point) represent random variables and decisions. Arcs into ran- 
dom variables indicate probabilistic dependence, while arcs into decisions specify 
the information available at the time of the decision. As an example, one node in the 
network may represent the weather, whereas another may represent the visibility. 
An arc from weather to visibility indicates that visibility is conditionally dependent 
on weather; see Fig. 5.8. The diagram is compact and intuitive, emphasising the 
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Fig. 5.8 Example for Bayesian Network for a navigating officer reacts in the event of being on 
collision course with an object, from Friis-Hansen and Pedersen (1998) 
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relationship among the variables, and yet it represents a complete probabilistic de- 
scription of the problem. For example, it is easy to convert any event tree or fault tree 
into a Bayesian Network. Conversely, it may not always be an easy task to convert a 
Bayesian Network into a combined fault tree and event tree, although theoretically 
possible. 

A drawback of Bayesian Network is that they require the state space of the ran- 
dom variables (the nodes) to be defined as discrete states. In our above-mentioned 
example of weather and visibility, the state space of weather may easily be discre- 
tised into states as good weather, storm, etc., whereas the state for visibility more 
naturally would have been defined as a continuous state space. The Bayesian Net- 
work modelling does, unfortunately, require the state space of visibility to be discre- 
tised in ranges as for example, 0-1 nautical miles, 1—2 nautical miles, etc. Although 
this is mentioned as a drawback, neither fault trees nor event trees offer any bet- 
ter alternatives. A consequence of the discretisation is partly that the result of the 
Bayesian Network may be sensitive to the selected discretisation, and partly that the 
calculations involved in the evaluation of the Bayesian Network grow almost expo- 
nentially with the number of states of the nodes as it address the entire probabilistic 
structure of the problem. 

A focus on the causal relationship among the variables is most effectively ac- 
complished by the building of a Bayesian Network. This implies that a Bayesian 
Network becomes a reasonably realistic model of the problem domain, which is 
useful when we try to get an understanding about a problem domain. In addition, 
knowledge of causal relationships allows us to make predictions in the presence 
of interventions. Last, but not least, the model building through causal relationship 
makes it much easier to validate and convey the model to third parties. We will not 
give any details here on how Bayesian Networks are analysed. Instead reference is 
left to Jensen (1996) and Pearl (1988). 

The Bayesian Network described above is taken from Friis-Hansen and Peder- 
sen (1998) where a comparative risk evaluation of traditional watch keeping and 
one-watch keeping has taken pace. The results of the modelling were compared to 
observations, and good agreement was obtained. Here we extend this modelling to 
also cover ship-ship collisions. 


5.3.2.3, Bayesian Network for Ship-Ship Collisions 


The network for predicting the causation factor for ship-ship collisions is rooted 
in the network shown in Fig. 5.8. The Bayesian Network was extended to model 
two ships, i.e. ship-ship collision situations. The network used for this analysis is 
presented as Fig. 5.9. It is seen that this Bayesian Network takes into account the 
correlation between the two vessels, that is, they have to detect each other under 
the same conditions. Although the network appears complicated, the elements from 
the basic network in Fig. 5.8 are recognised. It is noted that the two more isolated 
groups in the lower part of the network models the behaviour on the two bridges, 
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Fig. 5.9 Bayesian Network model for ship-ship collisions accounting for the correlation between 
the two vessels 


whereas the central group in the upper part of the figure models that the two vessels 
have to be detected by each other. 

From the Bayesian Network the calculated causation factor for meetings between 
conventional vessels is found to be 


P. = 9.00- 107°. 
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Table 5.1 Causation probabilities. (Fujii and Mizuki 1998) 


Log P aE P 
Head-on —4.31 0.35 4.90. 10-5 
Overtaking —3.96 0.36 1.10-10-4 
Crossings —3.89 0.34 1.29-10-4 
Grounding —3.80 0.26 1.59-10-4 
Object —3.73 0.36 1.86- 10-4 


Table 5.2 Weighing factors for headings 


Factor Psf 

0.5 2.45-10-> 
0.25 2.74-10-> 
0.25 3.22-10-> 


This value can be compared with observed causation probabilities determined 
from large data sets published by Fujii and Mizuki (1998). These observed values 
are given in Table 5.1. In Table 5.2 the different headings have been weighed to 
obtain one global causation factor. The result is that the observations indicate that 
the causation factor is close to 


P. =8.41-107-> 


That is a factor which is very close to the causation factor P. = 9.00 107° cal- 
culated by the Bayesian Network procedure for conventional vessels operating in 
geographical areas where the frequency of visibility less than 1 km is 3%. 

The modelling illustrates that it indeed is possible to establish a realistic mod- 
elling of the causation probability. 


5.3.3 Factors that Influence the Causation Probability 


As seen from the Bayesian Network analysis of the ship-ship collision above, it is 
indeed possible to accurately model the causation probability. It is, however, very 
important that the level of detail in the model is at a satisfactory level such that the 
results of the model become plausible. In this section we list some of the factors that 
influence the causation probability. 


5.3.3.1 Reported Causes for Grounding and Collision 
Several researchers have published reports on causes for marine accidents. All stud- 


ies define that the cause of a grounding or collision may be summarised crudely into 
the following four main groups: 
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1. Due to failure in manoeuvring, including inaccurate positioning and poor lookout. 

2. Due to incapacitation of personnel such as doze, drunkenness engaged in other 
tasks and sudden illness. Doze has been identified as one of the main causes for 
grounding. 

3. Due to technical problems with engine, steering gear, or navigational instru- 
ments. 

4. Due to environmental causes, such as visibility, wind, or waves. 


Group | and 2 in the list above represent the contribution from human errors. 
Unquestionable, human error is an important cause to navigational accidents — 
perhaps dominant, as it is quoted that human errors account for at least! 80% of all 
accidents. More precisely it could be stated that approximately 80% of navigational 
accidents involves at least some human errors or questionable judgements related to 
organisational factors. What complicates the assessment is that the blame (or cause) 
for an accident can be allocated in different ways according to the perspective of the 
investigator. Typically serious accidents start from basic human errors but the seri- 
ousness of the accident is rather a compound of a set of technical failure, operators’ 
error, fundamental design errors, and management errors. 

Therefore, any realistic modelling must provide a detailed representation of hu- 
man error in order to be successful. Unfortunately, the human error mechanisms 
differ from technical or environmental cause (viz. the remaining 20%), and are — in 
fact — not yet well understood. A major problem in this respect is that there exists 
no such thing as a recipe for doing a specific task in the right way (e.g. performing 
a turn). In an examination of a series of manoeuvring simulations that have led to 
a grounding accident, (Thau 1999, Personal Communication, Danish Maritime In- 
stitute, Denmark) found that the primary human error leading to the accident often 
occurred more than 10 min prior to the accident. Contrary, technical or environmen- 
tal causes are generally simpler to model and understand. 


5.3.3.2 Human and Organizational Errors 


Human errors can be described as actions taken by individuals that can lead an 
activity (design, construction, and operation) to realise a quality lower than intended. 
Human errors also include actions not taken, as these also may lead to an activity 
causing a quality lower than intended. Many people typically think of human error 
as “operator error” or “cockpit error’, in which the operator makes a slip or mistake 
due to misperceptions, faulty reasoning, inattention, or debilitating attributes such 
as sickness, drugs, or fatigue. However, there are many other important sources of 
human error. These includes factors such as management policies which pressure 
shipmasters to stay on schedule at all costs, poor equipment design which impedes 


' Some researchers even argue that 100% of all accidents are due to human error, since poor man- 
machine interface, failure of instrumentation (should have been checked more properly), under 
design, etc. all may be attributed to some sort of human error. Note that any design, construction 
and fitting are the result of human decisions. 
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the operator’s ability to perform a task, improper or lack of maintenance, improper 
or lack of training, and inadequate number of crew to perform a task. 

The human error factors range from those of judgement to ignorance, folly, and 
mischief. Inadequate training is the primary contributor to many of the past fail- 
ures in marine structures. Also boredom has played a major role in many accidents. 
Based on a study by Bea (1994) of human error factors in marine engineering the 
following primary factors were identified: 


Inadequate training Carelessness Ego 
Physical limitations Wishful thinking —_ Laziness 
Inadequate communication Ignorance Greed 
Bad judgment Negligence Alcohol 
Fatigue Folly Mischief 
Boredom Panic Violations 


Organisational errors are a departure from acceptable or desirable practice on the 
part of a group of individuals that cause unacceptable or undesirable results. Primary 
organisational error factors include, (Bea 1994): 


Ineffective regulatory Complex structure Violations 
requirements 

Poor planning/training Cost-profit incentives Ineffective monitoring 
Poor communications Time pressures Ego 

Low quality culture Rejection of information — Low worker morale 


For example, the goals set by the organisation may lead rational individuals to 
conduct certain operations in a manner that the corporate management would not ap- 
prove if they were aware of their reliability implications. Similarly, corporate man- 
agement, under pressures to reduce costs and maintain schedules, may not provide 
the necessary resources required allowing adequately safe operations. 

Other types of organisation and management procedure that affect the system re- 
liability include, for example, parallel processing such as developing design criteria 
at the same time as the structure is being designed — a procedure that may not be 
appropriate in economic terms according to the costs and uncertainties. 


5.3.3.3 Human Error Evaluation 


To date, four methodologies have been developed or adapted for maritime use. 
These are: 


1. The operator function model (OFM) task analysis 
2. Cognitive task analysis 

3. Skill assessment 

4. Error analysis 
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The OFM task analysis, developed in 1986 by Mitchell and Miller, see e.g. Ras- 
mussen and Whetton (1993), provides a breakdown of a function (such as avoiding 
collisions with neighbouring vessels) into the tasks that must be performed. This 
also includes the information needed to perform each task, and the decisions that 
direct the sequence of tasks. This type of task description is independent of the au- 
tomation; that is, the same tasks, information, and decisions are required, regardless 
of whether they are performed by a human or by a machine. For example, in col- 
lision avoidance, other vessels must be detected, their relative motions analysed to 
determine whether there is a threat of collision, and a decision made regarding how 
to change own ship’s course or speed in order to avoid a potential collision. These 
tasks must be performed regardless of who (human or machine) executes them. 

The cognitive task analysis method extends the OFM by considering the mental 
demands that would be placed on a human operator while performing tasks. For 
example, in order for a human to detect a new ship as soon as it appears, vigilance 
(sustained attention) and discrimination (the ability to spot a target against the back- 
ground) are required. The mental demands of analysing the relative motion of the 
target vessel include plotting a series of target ranges (distance) and bearings (its 
angular position relative to own ship) and evaluating the ratio of change over time. 
Hollnagel (1996) introduced a task transaction vocabulary that categorises men- 
tal demands, such as “search”, “detect”, “code”, “interpret”, and “decide/select”’. 
Assigning the appropriate OFM tasks to humans or machines can thereby repre- 
sent different levels of automation. Then the cognitive impact of automation can 
be identified by comparing the number and types of cognitive demands placed on 
the human operator under the different levels of automation. For example, Froese 
et al. (1996) found that when collision avoidance by manual methods was compared 
to the use of ARPA radar, then virtually all of the computational demands of the 
manual method were eliminated through automation. 

In order to evaluate the impact of automation on training requirements, a skill 
assessment technique was developed at US Coast Guard by combining the OFM 
and cognitive task analyses with the Knowledge, Skills, and Abilities (KSA) anal- 
ysis. The skill assessment is performed by taking each cognitive task (from the 
OFM/cognitive task analysis) and determining what types of knowledge or skill is 
required for the proper performance of a task. The hybrid analysis thereby focuses 
on the knowledge and skill assessment at the task level. For example, when com- 
paring the manual task in collision avoidance of plotting target range and bearing to 
the automated scenario that displays target information on the ARPA, then the ba- 
sic knowledge requirements of collision avoidance do not change with automation. 
However, the procedural requirements change radically. That is, the mariner has to 
understand the theory behind collision avoidance regardless of the level of automa- 
tion, but the specific set of procedural knowledge and skills the mariner needs is 
dependent on the level and type of automation. Application of the described skill 
assessment technique has allowed both US Coast Guard and Schraagen et al. (1997) 
to distinguish changes in skill level as a result of automation. 

The studies by Froese et al. (1996) and Schraagen et al. (1997) conclude that 
the way an automated system is designed can also affect the mariner’s performance. 
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Some automation “hides” information from the mariner, presenting only what the 
designer thought was needed. Unfortunately, many system designers do not fully 
understand the user’s task, and consequently we end up with less-than-perfect, error 
inducing designs. By studying the types of errors commonly made by operators, 
and by understanding the ramifications of these errors (i.e., are they just nuisance 
errors or can they cause an accident?), important information is gained that further 
can be used in training and system redesign. Both error analyses adopted in these 
references consisted of interviewing mariners and instructors, and observing the use 
of automation during routine shipboard operations. 


5.3.3.4 A More Detailed Collision Approach 


In Fig. 5.10 a sketch of the starting point of a more detailed collision approach 
model is seen. The idea is that our own vessel is on collision course with an object. 
Given the weather condition we can calculate when it is possible to see the object 
either visually, by radar or by AIS. Knowing the speed of the two vessels and the 
angle between them we can calculate the relative speed and the therefore the time 
available, T,, before a collision. Now the officer on the watch has to detect the 
collision danger this takes Ty. Then a plan has to be made which takes T,. At last, 
a manoeuvre must be made which takes T,, to perform. If T; - Tg — Tp — Twn is less 
than zero then a collision occurs. 

Given a number of specified input variables and a weather condition, a collision 
scenario is setup, Fig. 5.11. In this, the time available before a collision occurs 
is calculated. In the Time for Detection network the time it takes the navigator to 
detect a collision danger is estimated. This depends on the vigilance of the navigator 
and on the bridge layout. From the collision scenario a Collision Diameter is also 
established and based on this the time the ship has in order to do a manoeuvre to 
avoid the collision is calculated. When the collision danger is detected the navigator 
has to make a plan to avoid the collision. The time for this is calculated in the 
network Time for Planning. At last it can be determined if a collision happens or 
if there is time to avoid it. In short the network calculates the surplus time before a 
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Fig. 5.10 Sketch of the collision scenario 
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Fig. 5.11 Bayesian Network of the collision model. Each rectangle represents sub networks 


In the following examples, there are two ships sailing head-on between 0-30°. 
The network needs information as regard to the area, traffic, bridge layout, 
competence of the crew and so fourth. These are not specified here. In Fig. 5.12 
the result from the network analysis is shown given different initial distances and 
speed of the ships. 

The figure shows for instance that if the two ships sail between 5—10 knots and 
the initial distance between them is 0.6—1.25 nautical miles then the probability of 
a collision is 46.8%. The figure shows that the network behaves correctly, but the 
probabilities of collision are higher than should be expected. 


5.3.3.5 A Similar Approach for a Grounding Model 


In the following, a sketch of a more detailed grounding model is presented. The 
idea is that our own vessel is on grounding course with an obstacle. Given the 
weather condition we can calculate when it is possible to see the object either vi- 
sually, by radar, by AIS, by ECDIS or by an echo sounder alarm. Knowing the 
speed of our ship we can calculate the time available, T,, before grounding. Now the 
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Fig. 5.12 Examples of result from the collision network 


officer on the watch has to detect the grounding danger, this takes Tg. Then a plan 
has to be made which takes T,. At last a manoeuvre must be made which takes Ti, 
to perform. If T, - Tg — Tp — Tm is less than zero then grounding happens. This is 
sketched in Fig. 5.13. 


ran 


Aes EN, 
ae Initial distance = f(Visual-,Radar-,AlS-distance) | Seo [extent of 
Own vessel > - - - Plo, object 
ca Time avaiable Ta = Distance / v, Vocus 7 
ie Wee 


: : Elec. marked underwater 
Time for detection Td Unmarked underwater 
Time for planning Tp Small and visible 
Time for manouvering Tm Large and visible 


lf Ta-Td-Tp-Tm < 0 then grounding 


Fig. 5.13 Sketch of the model for calculating if grounding occurs 
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Fig. 5.14 Bayesian Network of the grounding model. Each rectangle represents sub networks 


An overview of the entire model is shown in Fig. 5.14. Each rectangle represents 
a sub network with several input and output nodes. Given a number of input vari- 
ables and a weather condition, a collision scenario is setup. In the scenario network 
the time available before grounding occurs is calculated. In the Detection the time 
network the time the navigator takes to detect a grounding danger is estimated. This 
depends on the vigilance of the navigator and of the bridge layout. When the ground- 
ing danger is detected the navigator has to make a plan to avoid the grounding. The 
time for this is calculated in the network Time for planning. The manoeuvring time 
to avoid the grounding is calculated in the Time for manoeuvring network. At last it 
can be determined if grounding happens or if there is time to avoid it. 

The result of the grounding network could be something like that depicted in 
Fig. 5.15. Here we see the times available in the different phases. The overall result 
is that for this particular scenario the grounding probability is 40.46%. The proba- 
bility of having between 0 and | min is 4.94%. The specific scenario is not shown 
here, as the objective has been herein only to sketch the grounding model. 

Overall the grounding network presented here behaves correctly, meaning that 
increases or decreases in parameters, result in the correct increase or decrease in the 
grounding probability. The actual values of the grounding probability seem however 
to be too high. 


5.3.4 Damage After a Collision 


Finally an approach for estimating the collision damage to a struck ship is pre- 
sented. The method involves calculating a large amount of collision damages and 
then training an artificial neural network to predict these damages. The input to the 
neural network is a few parameters on the striking and struck ship such as the size 
and speed. 
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Fig. 5.15 Example of result from the grounding network 


Risk consists of likelihood and consequence. When performing a risk analysis 
these two issues must be addressed. In case of ship collision and grounding the 
consequence could be the size of the damage to the struck ship (the striking ship 
is assumed not to be seriously damaged). The most accurate way for calculating 
the damage is using structural finite element (FEM) procedures. The drawback of 
this is that setting up a FEM model and doing the non-linear calculations is very 
time consuming. Another method is semi-analytical. This is relatively fast, a ship 
scenario can be set up within half an hour and the actual calculation takes seconds. 
The results are good compared to real cases. 

For risk analysis where hundreds or thousands of damage scenarios are needed 
the semi analytical method is still slow and time consuming to set up. The idea has 
been to train an artificial neural network (ANN) with already calculated damage 
scenarios and then use it to predict damages for other ships. The advantage of a 
neural network is that it is fast and simple to implement. The disadvantage is that it 
might not come up with a correct answer if no similar data exists. 


5.3.4.1 Data Used for Training the ANN 


An illustration of the collision scenario has been sketched in Fig. 5.16. Depending 
on the existence of a bulbous or no bulbous bow on the striking ship the result is one 
or two damage holes. 
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Fig. 5.16 Illustration of damage when the striking vessel is equipped with or without bulbous bow 


Two collision networks were trained with results published in the open literature. 
In the first the striking ship has a bulbous bow and in the second not. The input to 
the neural network is then the values given in Table 5.3. 

From the input listed in Table 5.3, the bulbous bow network calculates the dam- 
age outcome given in Table 5.4. In this table, the first column is the penetration 
divided with the breadth of the struck ship. The second column is length of the 


Table 5.3 Inputs to the artificial neural network 


Energy [kJ] Angle Lppstruck Lpp striking Draught striking 
38948 150 180 160 9.2 


Table 5.4 Inputs to the artificial neural network 


dxU/L dxL/L 
Pen/B dzU zU dzL zL 
upper lower 


0.098 0.112 3.57 14.8 0.003 1.93 2.6 
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upper hole divided by the length of the struck ship. The third column is the height 
of the upper hole and the fourth column is the vertical location of the upper hole. 
The three last columns refer to the lower damage hole created by the bulb. 


5.3.4.2 Validation of the Neural Network 


The network predicts its training data extremely well. In Fig. 5.17 the penetration 
prediction of the training data are shown for the case of ships without a bulbous 
bow. It is seen that network predicts the smooth blue line very well. 

The network has also been tested on ships that were not used in the training. 
Here the results are more ambiguous. Figure 5.18 shows an example of this. Here 
the penetration for a new RoRo ship is shown as a function of the speed of the 
struck ship. The penetration calculated by a semi analytical method is also shown. 
It is seen that up to 10-12 knots the calculated penetration corresponds well to 
the penetration from the semi analytical approach. But above this speed it starts to 
deviate seriously. This trend is also found for other ships. Hence, for speeds below 
12 knots the network can be used for rough estimates of the damage after collision. 


ANN accuracy for indentation 


Data 
o 
wn 


o 0 861000 1500 200 200 300 300 #4000 4500 

i 
Fig. 5.17 Accuracy of the penetration prediction. The smooth thick blue curve corresponds to the 
training data. Red x are the predictions. Non-bulbous network. The x-axis is the scenario number 
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Fig. 5.18 Predicted penetration for a ship not used in the training of the ANN 


Table 5.5 Data for the two ships in Fig. 5.17 


Striking Struck TFS = 
io} pea | co | com | sen | es | oe | oo | “lp 
Length pp 85.0m 190.3 — - 
Breadth 13.6m 26.50 — 
alee =| 
Draught 5.7m 6.95 Wy f\ fe = 
Displacement 5700t 22600 — 7 


A line with the ANN adjusted is also shown, but lacks generality and will not be 
discussed herein further (Table 5.5). 


5.3.4.3 Conclusion for the Collision Network 


An artificial neural network has been established for predicting the size of damage 
after collision of two ships, where the struck ship is a RoRo vessel. The striking 
ship, with or without a bulbous bow, hits the struck ship in the side and creates 
one or two holes modelled as rectangular boxes. Here the focus is on getting the 
penetration correctly, as the other dimensions of the box can be estimated from the 
size of the striking ships bow. 

The network estimates the training data very well. When estimating the pene- 
tration of ships not used for training the results are a bit more ambiguous. But for 
collision speeds in the range 0-12 knots the results of the uncorrected network are 
reasonable. The speed of the striking ship should in general be equal to the speed 
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of the struck ship. However, if the struck ship’s speed is zero the network still gives 
good results. 

The parameter studies performed show that the network behaves well in most 
cases. The network did not show a very strong correlation between the size of the 
striking ship and the penetration into the struck ship. 


Acknowledgments Section 5.3 is written by Dr. E. S. Ravn, based on information from work of 
Peter Friis-Hansen, Preben Terndrup Pedersen and Erik Sonne Ravn. 
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5.4 Structural Failure 


During the last decades there have been considerable developments of methods and 
tools for structural reliability assessment, as reviewed by Rackwitz (2001) and to be 
found in textbooks as e.g. Madsen et al. (1986). 

The applications of these methods have varied in different areas of engineer- 
ing. They were first applied in civil engineering where the most notable advances 
were registered both in the area of research as well as in their use in construction 
codes and regulations. Reliability methods and risk analysis have long been used 
in the offshore industry, being introduced into the regulations governing design and 
construction of offshore platforms. The maritime industry has been slower in adopt- 
ing these methods but recently studies can already be found on specific aspects 
and a general implementation of these methods to various aspects of ship design is 
underway. 

The application of structural reliability to the analysis and design of structures 
developed in complexity and detail at the same as the reliability methods were 
evolving. The first formulations proposed by Mansour (1972) and Mansour and 
Faulkner (1973) basically contemplated one variable which represented the loads 
derived from all cargo on the structure and another variable that represented the 
strength of the structure. Only with the development of the First Order Reliability 
Methods (FORM) (Rackwitz and Fiessler 1978) it was possible to progress and start 
to deal with problems relevant to engineering. These methods evolved to efficiently 
solve the problems of many variables by computational means, to take into consid- 
eration information about the type of probabilistic distribution of each variable and 
even to solve series, and parallel, systems of various components. There were also 
appreciable advances in efficient methods to reduce the variability of the results ob- 
tained from Monte Carlo simulations, which came to be utilized as an alternative, 
or as a complement to first order methods. 

This set of methods operates with random variables, which keep therefore their 
properties constant during the lifetime of the structures. Therefore, the set of prob- 
lems which are solved by this type of methods have become known as time-invariant 
methods. 

This designation appeared in contrast to time-variant methods, which recognize 
that random variables vary in time and in reality they are random processes. This 
type of model describes, for example, components subject to degradation or cor- 
roding or loads which vary significantly in time. Typically these models allow the 
representation of the effect of structural degradation and of repairs which serve as 
the basis to establish policies of maintenance or of structural design bearing in mind 
their future maintenance. 

Currently, structural reliability methods are used mainly to evaluate the implicit 
reliability level of ship structures for different failure modes with the state-of-the- 
art models and representative uncertainty measures, and to calibrate design formats 
where a consistent reliability level is required. 

The reliability index obtained by a structural reliability analysis is a nominal 
value, dependent on the analysis models and uncertainties included, rather than an 
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absolute reliability value, which maybe given a frequency interpretation. Therefore 
the calculated reliabilities can only be compared when they are based on similar 
assumptions with respect to analysis models and uncertainties taken into account. 
In this context an important application the structural reliability methods is on the 
assessment of the notional probability of structural failure that result from different 
ship types as well as from different actual concepts of the same ship (Guedes Soares 
and Teixeira 2000). More recently structural reliability analysis has been used to 
assess the safety level of damaged ships structures due to accidental events, as to be 
discussed at the end of this section. 

One of the main applications of the structural reliability methods has been as 
a tool for codified design and in particular to derive probabilistically based partial 
safety factors. Although, several application examples have already been published 
along the years, showing how reliability analysis could be applied to the analysis 
of ship structures, only relatively recently have the Classification Societies been 
motivated to incorporate the results of such studies in their codes by calibrating 
design formats for a consistent reliability level (Guedes Soares and Moan 1985, 
Spencer et al. 2003, Teixeira and Guedes Soares 2005, Harte et al. 2007). 

The present contribution aims at reviewing some recent work that has been per- 
formed on topic of the probabilistic assessment of ship structural safety. It will 
concentrate on the type of reliability formulations that are presently in use for 
ship structures. It discusses the formulations for hull strength and then the prob- 
ability models of the still-water loads, of the wave induced loads and of load 
combination. Finally it deals with the formulations for reliability of damaged 
structures. 

This work concentrates on the ultimate collapse situation and does not discuss 
the fatigue reliability case which is generally considered a serviceability limit state 
and is studied in connection with maintenance and inspection planning, as reviewed 
by Guedes Soares and Garbatov (1996). 


5.4.1 Probabilistic Modelling of the Strength 
of Ship Structures 


In order to be able to determine structural reliability of the ship it is necessary 
to evaluate the longitudinal strength of the hull girder and to define probabilistic 
models which can characterise the variability expected from the structural strength 
estimates. 

In general, the manner in which structural collapse can occur include reaching 
the yield stress, with the beginning of plastic flow, the elasto-plastic buckling sub- 
jected to the compressive load effects, and the increase of fatigue cracks or facture. 
These various collapse modes have different consequences that also result from the 
importance of structural component. 

Typically, global structural behaviour, also called primary, is considered to be ev- 
erything involved in the behaviour of the structure as a whole, that is, its bending as 
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a beam. Secondary structures are normally important components such as the deck 
or the bottom of the ship and tertiary components are typically panels or stiffened 
panels. 

On a global behaviour level, Classification Societies Rules used to relate the lon- 
gitudinal strength of the ship with the bending moment that causes the beginning 
of yield on the deck or on the bottom, which once more is a conservative situation 
since the structure normally has higher strength. This strength comes not only from 
material properties but also from the geometrical characteristics of the structure. 
Considering the global flexibility of the hull as a beam, the moment M, correspond- 
ing to the elastic stresses that develop is given as 


M. = Ze0y = +6, (5.2) 
where Oy is the yield stress of the material and Z, is the elastic modulus of the 
section given by the ratio of the moment of inertia of the section J, by the distance d 
of the neutral axis to the end of the section. This formulation allows the calculation 
of the moment, which corresponds to the reaching of the yield stress on the deck or 
bottom and is therefore a lower limit of the moment that makes the section collapse. 
The higher limit is given by the plastic moment that represents the moment that is 
necessary to apply to the section in order for it to collapse with all the material of 
the transversal section totally plasticized. 

Although the elastic bending moment has been widely treated as a measure of 
longitudinal bending strength of the ships, it does not provide with information con- 
cerning their resistance in extreme conditions. This can be achieved by the evalu- 
ation of ultimate capacity — maximum bending moment a hull can carry — which 
becomes an important parameter in ship structural rational design and in the relia- 
bility analysis of ships. 

One of the first methods for calculating the ultimate strength of a midship sec- 
tion was suggested by Caldwell (1965). In the method the structural members were 
lumped into panels and as the collapse load was known, either from experiments or 
analytical methods for each panel, the collapse moment of the midship section was 
estimated by simple summation. In this way the method indirectly accounted for 
buckling of compressed members as well as yielding of tensile members. However, 
Caldwell’s method did not account for the post-collapse strength of the structural 
members which significantly influence the collapse strength. This problem was ad- 
dressed by Smith (1977), who assumed that each element of the cross section, made 
up of a longitudinal stiffener and the respective associated plate, behaves in its pre- 
and post-collapse phase, independently from the neighbouring components and that 
the contribution of the various components is summed up to produce the bending 
moment which makes the transverse section collapse. In this way, the ultimate mo- 
ment of the transverse section, M,,, is given as: 


2 Oui 
M, = pa 6, djOy (5.3) 
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where d; is the central distance of the structural element to the neutral axis, O,; is 
the ultimate strength of each element which can be the yield stresses oy if it is in 
tension or the elasto-plastic buckling stress, O;, if it is in compression. A number of 
calculation methods that adopt this type of approach have been proposed and they 
were compared in a recent ISSC study (Yao et al. 2000). The FEM can also be a 
powerful method to perform progressive collapse analysis of ships. However, the 
hull girder is too complex to perform progressive collapse analysis by the ordinary 
FEM and therefore most of the studies on the probabilistic modelling of the ultimate 
strength of hull girders have been based on predictions of Smith-type simplified 
progressive collapse methods. 

In several reliability analyses the calculated bending moment by the deterministic 
methods has been considered to be the expected value of the ultimate strength of the 
mid-ship section, and all uncertainty in the prediction is concentrated in a model 
uncertainty random variable. A log-normal distribution with a mean value of unity 
is usually selected to describe this model uncertainty. It takes into account both the 
uncertainty in the yield strength and the model uncertainty of the method to assess 
the ultimate capacity of the mid ship section. Since the coefficient of variation of the 
yield strength of the steel normally range from 8 to 10% it has been assumed that the 
additional uncertainty will bring the overall coefficient of variation to 0.15 (Guedes 
Soares and Teixeira 2000). This result has been demonstrated by Hansen (1996) 
who quantified the uncertainty of the predictions of hull collapse, showing that it 
is very small and dominated by the uncertainty of the yield stress of the material, 
slightly increased by the uncertainty of the collapse strength. 

Alternatively, First Order Second Moment approaches, Monte Carlo simulation 
or response surface methods can be used to construct the probabilistic models of the 
ultimate strength of the ships based on the probabilistic models of the geometrical 
and material properties of the mid-ship cross section. 

As indicated previously, the hull collapse moment is a result of the contribu- 
tion of the different plate elements that make up the cross-section. Therefore the 
basic structural element is the plate and the next step in the level of complexity is 
the stiffened panel. It has been shown by different authors that the strength of the 
plate elements depend on the shape and amplitude of initial imperfections, on the 
level of residual stresses and on the boundary conditions. Although there are sev- 
eral simplified formulations to predict the strength of plate elements under uniaxial 
compression, as reviewed by Guedes Soares (1988), probably of the most used is 
due to Faulkner (1975). 


5.4.2 Probabilistic Modelling of Still Water Induced Loads 


The still-water load effects result from the longitudinal distribution of the cargo on- 
board and thus they are likely to change at each departure and even smaller changes 
may occur during a voyage. Once the distribution of cargo is known, the still-water 
load effects can be calculated. They include bending moment, shear force and lateral 


236 J. Jensen et al. 


pressure, but typically, the most important still water load is the vertical still water 
bending moment. The still-water load effects will vary with time and so they can 
only be described by a probability distribution (Guedes Soares and Moan 1988, 
Guedes Soares and Dogliani 2000). 

Recently, characteristic values of the loading manual (such as its maximum 
value) have been adopted to define the probabilistic models of the still water bending 
moment used in the reliability analysis of individual ships. (H@grte et al. 2007) found 
that the mean value of the still water bending moment in sagging was between 49 
and 85% of the maximum value in the loading manual. They also found that when 
the mean value of still water bending moment is large the standard deviation is rel- 
atively small. Based on the analysis of 8 test tankers, Hgrte et al. (2007) proposed a 
stochastic model that describes the still water vertical bending moment by a normal 
distribution with mean value and standard deviation of 70 and 20% of the maximum 
value in the loading manual, respectively. 


5.4.3 Probabilistic Modelling Wave Induced Load Effects 


The models of wave induced load effects adopted in the first reliability formulations 
described the probability distribution of exceeding a given value of bending moment 
at a random point in time during the ships lifetime. They were a natural generalisa- 
tion of the models that described the long-term probabilistic nature of the waves. 

Wave induced wave loads are normally represented by a succession of stationary 
sea states during which the amplitude of load effects follows a Rayleigh distribution. 
The transfer functions are calculated by strip theory and the most frequently used 
spectra to represent the sea states are the JONSWAP spectrum and the ISSC version 
of the Pierson-Moskowitz spectrum. 

The adoption of transfer functions is based on the hypothesis that the responses 
are linear and in that case they can also be represented by a stationary process which 
can be described by probabilistic models. 

In the case of ships the transfer function depends on the relative direction be- 
tween the ship and the waves, a, the speed V of the ship and the cargo conditions 
C. Therefore, the response spectrum Spr is conditional or depends on all of these 
variables: 

Sp (@,Hs,Tz,V,C) = Sy (,Hs,Tz).H’ (@,0,V,C) (5.4) 
and for each combination of variables, its variance is given by: 
R(Hs,Tz,a,V,C) = mo = [se (@,Hs,Tz,a,V,C)da (5.5) 
0 
where is the encounter frequency of the ship with the waves. 
This value of the variance is related to the specific situation of the sea state and 


operational condition of the ship. However, when considering any instant of time 
during the lifetime of the ship the value of the variance of the response at that instant 
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can be represented by a random variable. In this manner, the distribution of sea 
surface elevation or of any other variable obtained from it through transformation is 
obtained by weighing the conditional distributions by using the density function of 
the probability of the variance of response: 


co 


2, (2) = | O8(x\7) f(r) w()ar 6.) 


0 


where w(r) is a normalization factor which depends on the number of peaks in 
the considered time period, or what is equivalent, depends on the average response 
period in consideration. 

For reliability analysis, the resulting long-term distribution Q; (x), which rep- 
resents the exceedance probability of the vertical wave bending moment x, can be 
approximated to the Weibull distribution Fy gy(x) given by: 


x\k 
Fay (x) = 1—exp - (=) | (5.7) 

w 
where w and k are the scale and the shape parameters to be estimated from a Weibull 
fit of Fygm(x) to 1 — Q; (x) = P(VBM < x).The Weibull model fitted to the long- 
term distribution describes the distribution of the peaks at a random point in time. 
However one is normally interested in having the probability distribution of the 
maximum amplitude of wave induced effects in n cycles, where n corresponds to 
the mean number of load cycles expected during the ship’s lifetime. Gumbel (1958) 
has shown that whenever the initial distribution of a variable has an exponential tail, 
the distribution of the largest value in n observations follows an extreme distribution. 
Thus, the distribution of the extreme values of the wave induced bending moment 
over the time period T is obtained as a Gumbel law: 


F. (xe) = exp |- exp (-==*)| (5.8) 


Oo 


where x, and o are parameters of the Gumbel distribution that can be estimated 
from the initial Weibull distribution using the following equation: 


Xn =w: [In(n)] ; (5.9) 
o= 7 [In (n)] a (5.10) 


where w and k are the Weibull parameters and n is the return period associated with 
one year of operation. 

In the case of ships, the probability density function of the response variance is 
in reality a multivariate distribution dependent on different random variables: 
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f(s, 1z,8,V,C) = fo(|Hs ) fo (8 |Hs ) 


5.11 
fu (0 |Hs) fur (V [Hs fing my (st) fo (c) a, 


where fo is the density function of the probability of the directions in relation to the 
predominant direction of the waves, fp represents the directionality of the wave cli- 
mate, fy is the effect that the manoeuvre provokes during storms, conditional on the 
direction ©, on the speed V of the ships and on fc which is the probability density 
function of cargo conditions of the ships. It is worth noting that this equation implies 
that there is statistical independence between the cargo condition of ships and the 
wave climate, but that there is correlation between the climate and the manoeuvring 
effects as is understood by conditional distributions. 

The choice of probabilistic models which describe the wave climate to which 
structures are subject is an important element in the equation referred to above. Until 
very recently, the atlases with wave climate information which were available were 
based on visual observations and then on data calculated by reconstituted numerical 
models. The variability provoked by the chosen data can be overcome by adopting a 
reference wave climate with the agreement of the Classification Societies and which 
can serve as a comparison value for different designs of ships. 

The accuracy of the forecast of wave induced loads can also be improved, espe- 
cially for extreme cases by using non-linear theories, see e.g. recent ISSC studies 
Watanabe and Guedes Soares (1999) and Jensen et al. (2000). 

In order to reduce the computational effort the contour line method can be ap- 
plied. This method, proposed by Winterstein et al. (1993) is based on the idea of 
determining the contours of equal probability on the diagram of joint probability 
of significant height and peak period of sea states from the ones which have equal 
probability of originating responses of a certain level of probability. However, the 
responses are basically calculated with linear methods as the ones described in the 
initial part of this section. 

The advantage is that after having identified this, it is possible to calculate the 
non-linear response just for this small set of sea states and in so doing in a more 
consistent manner obtain the most probable maximum values of the type of loads to 
be considered, as suggested by Adeegest et al. (1998). 

These methods have been compared with the long term approach and with others, 
including the effect of abnormal or freak waves in Guedes Soares et al. (2008) and 
Fonseca et al. (2007). 


5.4.4 Load Combination 


In the reliability assessment of the primary ship structure it is required to know the 
maximum value of the two most important load effects. Considering that both have 
a Statistical variability due to different factors, it is easy to deduce that the maximum 
value of both does not occur simultaneously and therefore the maximum value of 
the sum of two loads is usually less than the sum of the two maxima that can occur 
in any time. 
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The reducing effect of the maximum value of the combined loads is taken into 
account in the regulations and in the reliability assessment of the primary ship 
structure by means of load combination factors, which can affect both the sum of 
two components as well as only the component that has the highest variability. 

The combination between the still water and wave induced bending moment 
(M,-) can be done using stochastic methods, which combine the stochastic processes 
directly, or by deterministic methods that combine the characteristic values of the 
stochastic processes. The different load combination solutions have been compared 
by e.g. Guedes Soares (1992) and Wang and Moan (1996). Turkstra’s rule is proba- 
bly the most often method applied. It assumes that, for the sum of two independent 
random processes, the total maximum moment occurs when either moment of the 
individual processes has its maximum value, 


Mie = max {(Mse +M,) ; (M, +Mye)} (5.12) 


where M,. and M,,. are the extreme value distributions of still water and wave in- 
duced bending moment, respectively, and M, and M,, are the arbitrary-point-in-time 
values of the random variables. Ferry Borges and Castanheta (1971) proposed a 
representation of a stochastic process as a sequence of pulses of a fixed duration 
as being equal to the average duration of the variable being considered. The prob- 
abilistic distribution F;¢ of the maximum value during n repetitions of the load i or 
equivalently during the time T = nt, where T is the pulse duration, is given by: 


Fre (x) = [Fx (x)]" (5.13) 


where F, (x) is the probability distribution function of the load intensity. This model 
has been adopted Ferry Borges and Castanheta (1971) to represent a combination 
of vertical bending moments induced on the ship hulls in still water and in waves. 
For this purpose, it is necessary to define the average duration of the voyages (T;) 
and the average period of the waves meeting the ship (%,,). In this case, defining 
the reference time period as T, the average number of voyages is ns = T/T; and on 
each voyage the average number of wave motion cycles which occur is ny = Ts/Ty 
(Fig. 5.19). Thus the distribution function of the maximum value of combined loads 
during a time period T is: 


Ns 


Fre (x) = : fms (2) - [Faw (x— z)]""dz (5.14) 


where z is an auxiliary variable, fis is the density distribution function of the still 
water bending moment in one voyage and [Fjy,|"" is the distribution of the ex- 
treme wave induced bending moment in one voyage, assuming ny wave loads in 
one voyage. The distribution of extreme combined vertical bending moment can be 
calculated for the different load conditions according to the operational profile that 
indicates the number of voyages ny in each load condition. 
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Fig. 5.19 Illustration of the Ferry-Borges model 


The most exact formulation is to consider both processes as being stochastic and 
then determine the average upcrossing rate of a given level Vie by the Mie process 
which represents a combined load as proposed in Guedes Soares (1992): 


oe i fay (Vg (2 yt ‘i Fits (2) Vity (x —2) d2 (5.15) 


where Vys represents the upcrossing rate by still water loads, which are modeled by 
a standard variable and vy, the rate of level crossing for a variable with Weibull type 
distribution, which was given by Naess (1984). These formulations have been used 
to determine the load combination factor Y by solving the following relationship, 


Fre (x) = Fre (x) So PFve (x) (5. 16) 


where extreme distributions are considered at 0.5 exceedance level. Thus, the com- 
bination factor is evaluated by: 


Fig! (x= 0.5) — Fg! (x= 0.5) 


= =] 
Fyre (x = 0.5) 


(5.17) 


Table 5.6 shows the resulting values of the load combination factor for a 236m 
long tanker in full, ballast and partial load condition, which lie within the range 
calculated by Guedes Soares (1992) and Casella et al. (1996). 
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Table 5.6 Values of the load combination factors 


Load cond. Fy! (x =0.5) F,! (x = 0.5) F,' (x =0.5) Sd 
(MN.m) (MN.m) (MN.m) 

Full load 1186 4210 5074 0.923 

Ballast load 1661 3751 5085 0.913 

Partial load 1545 3475 4337 0.803 


5.4.5 Reliability of Accidentally Damaged Structures 


Having the problem of reliability assessment of intact ships relatively well under- 
stood and incorporated in the rules of Classification Societies, the attention has been 
moving gradually towards considering at design stage how to better design ships so 
that they can still sustain some of the damage situations that are more likely to occur. 

The main consideration is the longitudinal strength of a damaged hull girder and 
a sub problem is the strength of damaged components such as panels. The studies 
concerning the survivability of ship following accidental damage lead to an impor- 
tant collection of hull damage data that can also be used to determine likely damage 
patterns for hull strength assessment. 

Finite elements are obviously adequate tools to predict the damage of ships in 
collision and grounding situations. However they are not practical tools to be used 
together with reliability assessments. Therefore it was only after approximate meth- 
ods have been applied to damaged sections that reliability approaches could be 
developed. 

Paik et al. (1998) developed a fast method to assessing the collapse of the hull 
girder in the damaged condition using the formulation of the American Bureau of 
Shipping. Gordo and Guedes Soares (2000) as well as Ziha and Pedisic (2002) 
adopted Smith type approaches to calculate the ultimate strength of damaged hulls. 
Fang and Das (2004, 2005) have adopted simplified methods initially developed to 
calculate the vertical ultimate bending moment to predict now the ultimate longi- 
tudinal strength of damaged ships. This type of methods have been compared with 
each other and with results of finite element calculation and shown to be consistent 
Guedes Soares et al. (2008). 

The approach generally adopted in these studies was to remove the elements 
within the damaged area from the section to be analysed and the ultimate strength 
was recalculated using the simplified method. It was found that the width of the 
damaged area influenced considerably the ultimate strength of the ship. However, 
accidental damages of ships can occur in any number of ways being the two most 
concerning ones the collision with other ships and grounding on rocky seabed. 

Luis et al. (2007) have used that type of approach to study the effect of the po- 
sition and extent of damage on the ultimate strength of the damaged ship providing 
thus useful insight about its effect on hull girder reliability. Luis et al. (2006) and 
Hgrte et al. (2007) have determined the reliability of damaged ship hulls by us- 
ing a FORM assessment. In addition to determining the ultimate strength of the 
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damaged section according to the methods just described the load conditions were 
based on the distribution for the intact ship, and the change in still water loads as a 
consequence of the damage was added by a deterministic value. Typically flood- 
ing of ballast compartments in the midship region was found most critical, and this 
causes the sagging moment to increase. 

Santos and Guedes Soares (2007) have developed an accurate method to deter- 
mine the still water bending moments during the flooding process and have shown 
that during transient situations the hull girder loads can be larger than in the steady 
state situation, a finding that needs to be taken into account in future reliability 
evaluations. 


5.4.6 Conclusion 


This section provides an overview of the reliability approaches that are presently 
available for the assessment of the reliability of ship hulls under intact and damaged 
conditions. Attention is given to the approaches to determine hull girder strength 
and to assess the still water and the wave induced load effect as well as their com- 
bination, which are the required information to perform reliability analysis. Finally 
reliability of damaged vessels was discussed. 

In general it can be said that there are a number of tools available to determine 
structural reliability which is mature to be applied in intact structures and has al- 
ready been applied to damaged structures. 
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5.5 Flooding 


The analysis of the dynamic behaviour of damaged ships in waves may be carried 
out today using theoretical-numerical models which allow the calculation of the 
nonlinear motions of the ship and the details of the flooding in the time domain. 
Numerical simulations of the damaged ship behaviour are an efficient way of eval- 
uating ship’s survivability compared to physical model experiments. In both cases 
the probability of capsize and/or sinking is calculated by inspecting the time series 
of roll and of other ship motions and related quantities. 

The accuracy of numerical calculations depends on the accuracy of the modelling 
of the physical phenomena and remains in some respects in doubt; a fact which is 
easily comprehensible given the complexity of the phenomena at stake. Numerical 
simulations are however very advantageous compared to physical model experi- 
ments due to their flexibility when attempting to vary systematically the variety of 
parameters related to the ship or to the sea environment. 

Numerical methods for damaged ship survivability in waves comprise the solu- 
tion of the ship equations of motion in the time domain. The results consist of the 
time series of ship motions and of the water mass in the flooded spaces and are 
free from typical limitations imposed by physical model experiments, like limits of 
tank dimensions, ship’s shell thickness modelling problems and rigidity in changing 
internal ship’s layout. 

Seakeeping models typically use formulations in the frequency domain, which 
are sufficient for most design purposes. However, when considering nonlinear phe- 
nomena such as large amplitude motions, effects of wave profiles on hydrodynamic 
forces, loads due to current, wind and mooring, forces due to flooding, a time do- 
main approach is required. Numerical models for calculating damaged ship dynam- 
ics in waves are formulated in the time domain and generally comprise three basic 
components: a model of the ship geometry including subdivision, a model for the 
sea environment and a model of the flooding process. These models and their inter- 
actions are integrated into the overall model of the damaged ship behaviour, which 
basically consists of the set of equations for ship motions under the effects of flood- 
ing and waves (Fig. 5.20). 

It is worth pointing out that the dynamic behaviour of the ship acts back upon the 
flooding because it interacts with the motion of water inside the flooded compart- 
ments. The main parameters of these models are listed in Table 5.7. 


5.5.1 Modelling the Sea Environment 


Most numerical models in the time domain use linear deep water theory. This the- 
ory proved to be adequate for modelling large amplitude waves in deep water, with 
good results regarding wave profiles, particle kinematics and pressure distribution in 
the proximity of the free surface. Its application to situations involving progressive 
flooding is therefore assumed adequate. However, modelling extreme phenomena 
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Environment and Progressive Flooding 


Fig. 5.20 Structure of damaged ship dynamics numerical models 


Table 5.7 Main parameters and characteristics of employed numerical models 


Model Main parameters 


Sea environment Wave theory, direction and spectrum, 
water depth, restricted waters, 
current, wind 

Ship and damaged compartments Hull shape, ship subdivision, 
geometry of damage, loading 
condition, ship speed 


Damaged ship Equations of motion Number of degrees of freedom 
behaviour numerical method 
Potential forces Hydrostatic forces, Froude-Krylov 
forces, radiation forces, diffraction 
forces 
Viscous forces Roll viscous damping, viscous 


coupling drift-roll, viscous forces 
due to manoeuvring, drift due to 
waves 

External forces Wind, cargo shifting, propulsion, 
resistance to advance, rudder, 
automatic pilot, mooring, collision 


Flooding Water in-/ouflow Hydraulic models, CFD 
Accumulation and motion of Static effects, dynamic and sloshing 
floodwater effects 
Progression of flooding Hydraulic models, CFD 


such as breaking waves is not possible by linear theory and these phenomena may 
be of interest when considering the behaviour of small ships in shallow waters in 
the presence of strong waves and currents. In these conditions, water rotational 
speeds may have a substantial importance in ship capsize, especially in beam seas. 
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However, for medium and large ships, these phenomena are less important since the 
probability of capsize is very small for such large vessels. 

Dynamic behaviour of ships is very much influenced by the direction of waves. 
Numerical models should be able to consider waves coming from different direc- 
tions, although today the situation predominantly studied for damaged ships is the 
beam sea condition, as it is the most serious. Furthermore, damaged passenger ships 
in case of severe flooding tend to stop and align themselves parallel to the predomi- 
nant wave crests. Most numerical results available today relate to beam seas, as this 
is also the classical case of damage ship stability assessment according to SOLAS 
regulations; Chang and Blume (1998) and Chang (1999) presented numerical results 
also for other wave directions. 

Numerical models describe the natural seaway by means of wave spectra, a tech- 
nique which allows the simulation of time series of the wave elevation resulting from 
the superposition of a large number of wave components with different frequencies, 
amplitudes and phases. This type of modelling of the sea surface is generally ad- 
equate to model wave conditions in a certain fixed point in space, assuming the 
wave elevation to be a Gaussian process and for large water depths. Most numerical 
models consider unidirectional sea states defined by use of the JONSWAP spectrum 
(for coastal waters), as reported in Guedes Soares (2003). For deep sea waters, the 
Pierson-Moskowitz or Bretschneider spectrum is more frequently used. 

In fact, as most passenger ships typically follow routes along the coasts, the JON- 
SWAP spectrum is generally found to be appropriate. Experimental results regarding 
the behaviour of damaged passenger Ro-Ro ships in irregular waves have been made 
available for sea states defined by JONSWAP and Pierson-Moskowitz spectra, as re- 
ported in (ITTC 2000). Waves are generally accompanied by wind, whose effects 
are generally important for passenger ships, for which the exposed areas are typ- 
ically very significant. Wind effects are generally modelled using constant wind 
speed profiles and empirical formulae. 

Shallow water effects can also be of importance since there are effects on the 
wave shape but also because squat effects can arise when the ship speed is sig- 
nificant. These types of effects are generally not considered in the damaged ship 
behaviour numerical models, except for Dand (1988) in a case of flooding through 
the bow door of a ferry under way; thus, shallow water effects should be consid- 
ered, when flooding occurs for a ship with speed, as most passenger ships travel 
along coastal waters with limited water depth and most accidents occur near ports 
where the water depth is even smaller. Currents are not considered in these models 
of damaged ship behaviour, although coastal areas are usually subject to strong cur- 
rents which also have effects on the waves and damaged ship behaviour. The effects 
of currents have not been considered in numerical models of this type so far, but can 
be included as external forces applied to the ship. 
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5.5.2 Modelling the Damaged Ship 


Several numerical models use strip theory for calculating the hydrodynamic forces, 
making it a requirement for the ship’s hull to be slender and be defined using trans- 
verse sections. Some recent numerical models use panel methods to obtain the hy- 
drodynamic forces and in these cases, the ship’s hull is described using panels, as 
reported in Zaraphonitis, Papanikolaou et al. (1997), offering the advantage of in- 
creased precision in these forces. 

Simulating the flooding of a ship in the presence of a certain sea state requires 
modelling both the geometry of the ship’s hull (wetted and dry surfaces) and of the 
damaged compartments. Most numerical models adopt this approach as reported 
in Van’t Veer et al. (2004). Modelling of the number, shape and location of the 
damage holes in the hull and between the different compartments is also required if 
progressive flooding is to be taken into account and simulated, as reported in Santos 
et al. (2002). Very often, the ship’s hull damage opening is specified as according 
to relevant SOLAS regulations (SOLAS 90 or Res. 14/SOLAS 95 provisions, IMO 
1995). 

The loading condition of the ship at the time of the accident is generally speci- 
fied in terms of her displacement and centre of gravity. Additionally, the moments 
of inertia of the ship are also required, which can be calculated from the ship’s 
mass distribution, if available or estimated using empirical formulae. The location 
of centre of gravity is important mainly for the hydrostatics and the inertias for the 
dynamic behaviour of the ship. The ship’s speed is also of importance since it in- 
fluences the hydrodynamic forces and causes additional wave systems which, for 
example, change the shape of the wetted surface. However, for reasons stated above 
and in compliance with relevant SOLAS regulations, the damaged ship is generally 
assumed at zero speed (dead ship condition) and excited by transversely travelling 
(beam) waves. 


5.5.3 Modelling Damaged Ship Dynamics 


5.5.3.1 Equations of Motion 


Most numerical models consider all six degrees of freedom of the ship and solve the 
equations of motion in the time domain. The first introduced models, like those of 
Sen and Koustantinidis (1987) and Spouge (1985) simply simulated the behaviour 
of the ship using a quasi-static approach. No wave effects were considered. De Kat 
and Paulling (1989), based on the works of Oakley et al. (1974) developed the 
first numerical model in the time domain capable of dealing with all degrees of 
freedom. Rakhmanin and Zhivitsa (1996) presented a set of simpler equations of 
motion which only dealt with drift, heave and roll. These equations included the 
dynamic effects of water inside the compartments by adding a set of terms to the 
intact ship equations of motion. A similar approach was used to include the effects 
of inflow/outflow. 
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Turan (1993) and Vassalos and Turan (1994) adopted a similar approach and 
presented a coupled model in three degrees of freedom. Lee and Adee (1994) pre- 
sented a numerical model of similar characteristics. Vassalos and Letizia (1995) and 
Letizia et al. (2003) further developed the work of Turan (1993) and derived a set of 
equations which included the effects of floodwater in a more realistic different way. 
A non-linear coupled six-degree of freedom numerical model, coupled with a water 
ingress/egress model was presented, characterised by the following set of coupled 
differential equations: 


(M+ M,,(t) +A]X(t) + [M(t + Briscous| X(t) + [xe = 1) X(t)dt a (5.18) 


= Fwave + Farift + Fyind + Feurrent + Frestoring a F gravitational — Fywod 


where: 


M is the ship’s mass inertia matrix 

M,,(t) is the flood water matrix moving independently of the vessel but with an 
instantaneous free surface always parallel to the mean waterline 

M,,(t) is the rate of flood water matrix (acting as damping) 

A is the added (hydrodynamic) mass matrix 

Byiscous 18 the viscous damping matrix 


t 
{ K(t—t)X(t)dT is the convolution integral, representing radiation damping 
0 


K(t —T) is the kernel function and 7 is the time lag 

F; are the various generalised force vectors comprising wave (1st and 2nd order), 
wind and current excitation as well as restoring, gravitational and water on deck 
effects. 


Numerical models of damaged ship dynamics were also further developed by 
others; Vermeer et al. (1994) introduced a model that considers the drift, roll and 
yaw motions and Journée et al. (1997) presented a six degrees of freedom model 
and its partial validation by model experiments. Spanos et al. (1997) introduced 
their work at the National Technical University of Athens (NTUA) on damaged ship 
dynamics and presented a six degrees of freedom numerical model, which is based 
on a 3D panel method for the calculation of the hydrodynamic forces; this work 
was later further developed by Spanos and Papanikolaou (2001). The theoretical 
approach of the NTUA model is similar to that of De Kat and Paulling (1989), 
except for the refined calculation of the hydrodynamic forces by a 3D panel method; 
additional equations are introduced describing the floodwater motions on deck or 
inside compartments by the lump mass concept and their coupling with the ship 
motions. 

Chang and Blume (1998) further developed the original work of Sdding (1987) 
and Kroger (1987) and presented a hybrid model which considers the six degree 
of freedom; however, some of the motions are determined by linear modelling in 
the frequency domain while the roll motion is solved in the time domain. The roll 
motion is determined using the following nonlinear motion equation: 
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o={ Mp M(g c) hs hz |(0+69°) sing - (V+yo?) cos | 
(5.19) 
+ Mwino + Mwoo + Msy +Mwave} | {b= he (ysing + @cos@) } 


where: 


M represents the mass of the ship 

¢ represents the heave motion 

@ represents the roll motion 

@ represents the pitch motion 

y represents the yaw motion 

[x represents the inertia around the longitudinal coordinate axis 

[,z represents the cross product of inertia 

hs is the righting arm in an “effective” longitudinal wave acc. to Grim and Séding 
Mp is the nonlinear damping moment taking into account the bilge keels 
Mvywwp is the moment of wind 

Mwop is the moment due to water motion on the vehicle deck and in compart- 
ments 

Msy is the roll moment due to sway and yaw motions 

Mwave is the moment due to waves. 


The main conclusion is that most recent models consider all degrees of freedom, 
but surge and yaw are frequently neglected. This is partially a consequence also of 
the fact that in resolution 14/SOLAS 95 (IMO, 1995) testing procedure, used as a 
standard case for comparison of obtained theoretical results, it is implied that ship’s 
surge and yaw motion are restrained, in order to keep the model in beam seas. 

Damaged ship behaviour numerical models should allow the prediction of cap- 
size, which occurs when the ship attains heel angles larger than about 25° to 30°, 
with currently no clear definition of the precise boundary. For this final stage of 
flooding, large angle rigid body mechanics is required and this leads to numerous 
nonlinearities in the equations of motion. Numerical models like those of Turan 
(1993) and Journée et al. (1997) did not consider large rotation angles. More re- 
cent numerical models, such as those presented by Vassalos and Letizia (1995) and 
Spanos et al. (1997), include proper modelling of these nonlinearities. The roll equa- 
tion of motion considered by Chang and Blume (1998) is also highly nonlinear with 
respect to the roll motion. The equations of motion in the numerical models are 
generally solved using the Runge-Kutta method, with the exception of the model 
presented in Spanos et al. (1997), which uses an extrapolation scheme. 


5.5.3.2 Potential Forces 


Hydrodynamic forces acting on the damaged ship are generally divided into po- 
tential forces and viscous forces. Potential forces are those that act on the wetted 
surface due to water, taken as an inviscid and irrotational fluid and viscous forces 
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are those arising due to viscosity. Potential forces can be further decomposed into 
Froude-Krylov, radiation and diffraction forces. 

Froude-Krylov forces result from the integration of the undisturbed incident 
wave pressure distribution along the wetted surface of the hull. Water pressure is of- 
ten decomposed in hydrostatic pressure and hydrodynamic pressure, which causes 
the Froude-Krylov forces. Various authors, such as Vassalos et al. (1997a,b) and 
Hutchinson (1995) indicate that these two forces, hydrostatic and Froude-Krylov, 
are dominant with respect to the dynamic behaviour of the ship, especially in beam 
seas. There are various options regarding the calculation of the Froude-Krylov 
forces with the most common being to integrate pressures over the mean wetted 
surface, an approach adopted by Turan (1993). Numerical models such as those of 
De Kat and Paulling (1989), Spanos et al. (1997) and Vassalos and Letizia (1995) 
calculate the Froude-Krylov forces taking into account the exact wetted surface un- 
der the incident wave. 

Radiation forces are the hydrodynamic forces associated with ship motion on the 
free surface. The most common method for calculating these forces is to use linear 
strip theory or a 3D panel method. This approach produces hydrodynamic forces 
in the frequency domain which can then be transferred to the time domain using 
the impulse response function method introduced by Cummins (1962). Numerical 
models such as those of De Kat and Paulling (1989), Spanos et al. (1997), Vassalos 
and Letizia (1995) and Journée et al. (1997) follow this approach ensuring proper 
consideration of memory effects. Models such as those of Turan (1993) and Chang 
and Blume (1998) used the frequency domain coefficients directly, at least for some 
motion responses. 

Diffraction forces are the hydrodynamic forces related to the perturbation of the 
incident wave (pressure distribution and wave profile) due to the presence of the 
ship’s hull. De Kat and Paulling (1989) indicated that these effects are of importance 
when the damaged ship is exposed to beam seas. Diffraction forces actually also 
involve memory effects and, therefore, the methods used for radiation forces could 
be also herein applied. However, numerical models similar to that of De Kat and 
Paulling (1989) use an equivalent method, which is based on the hypothesis that 
the motion has been going on for a long time and the use of the transfer functions 
of the diffraction forces from the frequency domain is sufficiently accurate. Most 
numerical models such as those of Vassalos and Turan (1994), Vermeer et al. (1994), 
Spanos et al. (1997) and Chang and Blume (1998) adopt a similar approach. 


5.5.3.3 Viscous Forces 


Viscous forces act in a similar way like the damping component of the radiation 
potential forces. In fact, the damping component of the radiation forces is frequently 
referred to as potential damping in contrast to viscous damping. Roll motion is that 
DOF in which viscous effects are very important. De Kat (1990) uses an empirical 
method by Himeno (1981) to calculate the viscous roll damping which is based 
on a decomposition of the viscous effects in components which are summed up to 
obtain linear and quadratic coefficients. De Kat (1990) uses, however, a different 


252 J. Jensen et al. 


approach by linearization of all the components of roll damping. The work of Ikeda 
et al. (1980) and more recently Ikeda (2002) is widely used for estimating the semi- 
empirical coefficients for the viscous roll damping. 

Viscous forces due to ship manoeuvring act on the horizontal plane and are of 
importance for the drift and yaw motions, when the ship at speed. The method of 
Inoue et al. (1981) or others of similar nature has been used to calculate these forces 
by De Kat (1990) and others. Other numerical models do not consider these effects 
as their main concern is the case in which the ship has no forward speed and is in 
beam seas. 


5.5.3.4 External Forces 


External forces comprise a variety of specific forces due to wind, cargo shift, propul- 
sion, resistance to advance, rudder, automatic pilot, mooring and collisions. These 
may be of relevance or not to the flooding, depending on the specific application of 
the numerical model. 

Wind can induce a significant inclining moment on the ship and has a negative 
effect on the roll motion of the damaged ship in severe sea states. Its main effect 
is a quasi-static heel angle to leeward, about which the ship rolls under the action 
of waves, as explained by De Kat (1990). Wind effects are especially important for 
passenger ships, typically characterized by large exposed areas, which tend to align 
themselves broadside to heavy seas when in damage condition. Isherwood (1973) 
published one of the first works on the effects of wind on ships. Most numerical 
models applied in damage stability assume a steady wind; recent works such as those 
presented by Vassalos et al. (2004) and Francescutto et al. (2001), regarding the 
weather criterion, contain interesting data for improvements in this area. It should 
be noted, however, that as the wind may be assumed acting in the same direction as 
the incoming waves that the flooding through a damage opening on the weather side 
is not increased due to the action of wind, therefore it is generally neglected in the 
assessment of the damaged ship’s stability in waves. 

Cargo shifting due to severe weather conditions is possible in many situations and 
is especially dangerous for Ro-Ro and containerships. Its main effect is to cause 
a steady list which generally causes an increase of the capsize probability. Most 
known numerical models do not consider this problem explicitly; but recent works, 
e.g. by Ericson et al. (2000), describe methods to predict the breaking of the lashing 
of Ro-Ro cargo due to extreme accelerations. 

Some numerical models, e.g. De Kat (1990), which also aim at studying the 
manoeuvrability of damaged ships, consider the forces associated with resistance, 
propulsion, rudder and automatic pilot. These forces are all included as external 
forces and calculated using different methods, some of them of empirical nature. 
Forces due to mooring are not commonly considered and the same applies to colli- 
sion forces, which nevertheless may be of interest in the initial transient phases of 
flooding, as mentioned by Spouge (1985). 
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5.5.4 Modeling Ship Flooding 


The modelling of ship flooding, under the action of waves, involves the following 
phenomena: 


e Inflow/outflow of water to the damaged compartments, 
e Accumulation and motion of water inside the damaged compartments, 
e Progressive flooding of ship’s compartments. 


The first two phenomena have been studied also for vessels with water on 
deck, namely fishing vessels and offshore vessels. Dillingham (1981) and Falzarano 
(2002) provide results on the effects of shallow water accumulated on large open 
decks. Inflow and outflow of water have been predominantly studied in connection 
with damaged Ro-Ro ship behaviour by Vassalos et al. (1997) and others. Progres- 
sive flooding has also been studied for similar ships by Spanos et al. (1997) and 
Santos and Guedes Soares (2001), for warships by Palazzi and De Kat (2003), for 
cruise ships by Van’t Veer et al. (2004) and fishing vessels by Spanos and Papaniko- 
laou (2001). 


5.5.4.1 Modeling Inflow/Outflow 


The correct modelling of the inflow/outflow process has a significant importance in 
the determination of time required to sink or capsize the ship and in the actual sur- 
vivability of the damaged ship. The amount of floodwater which flows at any time 
instance through the damage opening depends on the pressure difference between 
the inside of the damaged compartment and the exterior sea environment. The pres- 
sure distributions in the flooded compartment depend on the amount of water in the 
compartment, the phase lag of the flooded water surface relative to the ship motions, 
sloshing effects and shape of the free surface inside the compartment. Concerning 
the pressure distribution on the outside, the draft, trim and heel of the ship, the 
characteristics of the sea and radiation and diffraction effects all affect the pressure 
distribution. 

The first employed inflow/outflow model was a hydraulic model presented by 
Turan (1993); he assumed a stationary flow dependent on the heads of water on 
both sides of the damage opening. Also included in the formulation was a hydraulic 
coefficient, whose value was determined empirically from model experiments. Vas- 
salos and Turan (1994) introduced an expression derived from the Bernoulli theo- 
rem which allows the calculation of flow rates through infinitesimal elements of the 
damage. In general, the flow of water between two interconnected compartments 
depends on the difference of water levels between both compartments. Bernoulli’s 
theorem is first used: 


P P ’ 
hou + a +0=hi, + OH i a (5.20) 
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where hjy and hoy; are the water levels in both compartments, Pj, is the atmospheric 
pressure, p is the specific mass of the water, g is the acceleration of gravity and v is 
the water velocity, which can then be obtained through: 


v= V28(how — hin) (5.21) 


The flow rate is then obtained through: 


O= |f KV 2e(hou —hin)dA (5.22) 


where K is the hydraulic coefficient, obtained experimentally. The flow rate can then 
be multiplied by the time step and the amount of water which enters or leaves the 
compartment is obtained. 

Formulations of this type are also used in the works of Hutchinson (1995), Zara- 
phonitis et al. (1997), Vassalos et al. (1997) and Van’t Veer and De Kat (2000). 
Depending on the relative heads of water on both sides the damage opening at 
each moment, the flow rate can be estimated and the amount of water inside the 
compartment updated for the next time step. Vassalos et al. (1997) report good 
agreement between experimental results for damaged Ro-Ro ships and time domain 
simulations. 

The very nature of the related flow phenomena suggests that the intermittent 
flooding of the car deck of a Ro-Ro ship involves quite different phenomena. Out- 
flow of water may in many cases be similar to discharging from a dam, while inflow 
is typically a more complex problem. Hydraulic coefficients remain an important 
approach in the prediction of inflow/outflow for damaged ships as they well cap- 
ture the flow rate and the amounts of water in the different flooded compartments 
in the time domain. Typical values for hydraulic coefficients applicable to the prob- 
lem of progressive flooding of ships are scarce in the open literature. In that sense, 
studies such as that of Ruponen et al. (2006) are very valuable and point towards 
hydraulic coefficients between 0.6 and 0.8, with 0.7 being a common value. How- 
ever, the open literature reports hydraulic coefficients ranging from 0.5 to 1.2, with 
some dependence on the shape of the damage hole boundary. 

Some numerical models like that of Xia et al. (1999) and Ruponen (2007) also 
take into account the effect of air flows and entrapped air on the flooding process, 
which are phenomena of interest in specific situations, e.g. flooding of confined 
spaces, like the machinery room (Van’t Veer et a.l 2000 and Palazzi and De Kat 
2002). 


5.5.4.2 Modeling Floodwater Dynamics 


The static effects of water accumulation inside the compartments of ships are well 
known. The dynamic effects are not so well understood, however, and different ap- 
proaches may be followed regarding the treatment of the added mass of water con- 
tained in the different flooded compartments. In some numerical models, such as 
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that presented by Vassalos and Letizia (1995), the ship is taken as a variable mass 
system and added mass and inertia constitute an additional component of damp- 
ing. In a previous work, Vassalos and Turan (1994) adopted a different approach by 
considering the floodwater effects as external forces. 

Water accumulated inside the ship has also the effect of increasing the draft of 
the ship, with consequences on the hydrodynamic forces acting on the ship. Studies 
of this problem indicate that by most forces vary linearly with draft. Hydrodynamic 
forces associated with roll motion present, however, some nonlinearities as the ship 
becomes heeled. Trim effects may also be important in case of severe trims due to 
extensive flooding. The open literature is very poor with respect to studies concern- 
ing the effect of heel and trim on the hydrodynamic forces. 

The dynamics of floodwater inside compartments has been studied by various au- 
thors, with special focus on damaged Ro-Ro ships. The Ist related ITTC benchmark 
study, ITTC (2000), concluded that the final stages of flooding for Ro-Ro ships are 
quasi-static in nature, with significant decreases in roll motion in the final stages. 
However, during the slow flooding process of a Ro-Ro ship, the dynamic effects 
may be significant. Zaraphonitis et al. (1997) and Spanos and Papanikolaou (2001) 
indicate that the dynamic effects of sloshing are only significant when the excitation 
frequency is close to the natural frequency of the trapped water on the main deck. 
This matching should be very rare for Ro-Ro ships, due to common ship character- 
istics, but quite relevant to fishing vessel motions, when water is trapped on deck. 
Other authors, like Molyneux et al. (1997) indicate that in some circumstances these 
effects may be also significant for Ro-Ro ships. Another type of dynamic effects 
arises, as reported by Van’t Veer and De Kat (2000), when there are obstructions to 
the freely flow of water inside the compartments, which may cause the shifting of 
the natural frequency of the water inside the compartments towards common values 
of the natural roll frequency. 

Zaraphonitis et al. (1997) and Spanos et al. (1997) have adopted an approach in 
which the floodwater is taken as an independent oscillatory system with all its mass 
concentrated at its centre (lump mass concept). The equations describing the motion 
of floodwater are then solved in the time domain coupled with the ship equations 
of motion. The motion of the floodwater causes the occurrence of a second roll 
resonance independently of prime roll resonance of the ship, a fact also noticed in 
experimental results given by ITTC-Specialist Committee (ITTC 2003). The fre- 
quency and amplitude of the first roll peak and the presence of a second smaller 
peak at higher frequencies has been explained by Santos and Guedes Soares (2008) 
using a shallow water theory to describe the behaviour of water inside flooded com- 
partments located below the main deck. 

Dynamic effects may also be included using an approach by Vassalos et al. (1997) 
which uses empirical data from model experiments to build a database on phase and 
amplitude differences between ship motions and floodwater motions. 

Finally, the behaviour of floodwater can also be described using computational 
fluid dynamics methods. Van’t Veer and De Kat (2000) applied the Volume of Fluid 
(VOF) CFD method introduced originally by Hirt and Nichols (1981). This ap- 
proach encompasses the discretization of the space of the flooded compartment, 
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which is not occupied with machinery or cargo, by small volumetric elements. The 
equations of motion of the fluid are than solved and the velocity field obtained. 
Spaces occupied by equipment or cargo are modelled as impermeable cells. The 
numerical results obtained in the mentioned study compare quite well with experi- 
mental results obtained by forcing the oscillation of a model of the damaged com- 
partment. However, the authors indicate that 3h computing time are required to 
simulate 10s of fluid motion. 

Armenio and La Rocca (1996) presented a method for simulating fluid dynamics 
inside flooded compartments using the Navier-Stokes equations. Woodburn et al. 
(2002) use a similar approach in connection with turbulence models, using also the 
volume of fluid method to take into account the free surface. The forces obtained us- 
ing these methods are then applied in the ship equations of motion as external forces. 
Again, this approach showed considerable computational time and some discrepan- 
cies compared to experimental results. 

Another approach to the problem of calculating the motion of floodwater, ap- 
plicable when its depth inside the compartment is small, is to use shallow wa- 
ter flow theory. The flow is then described using nonlinear hyperbolic equations 
which can be solved numerically using the random choice method described in 
Glimm (1965). This method permits obtaining the velocity and water depth in 
cells across the flooded compartment and may also be used for studying the wa- 
ter on deck problem. Dillingham (1981) used the method for one-dimensional cases 
and Pantazopoulos (1988) and Huang and Hsiung (1996) extended the method for 
three-dimensional flows. Santos and Guedes Soares (2003, 2008) applied the same 
method to describe the floodwater motion inside a flooded compartment under the 
main deck. 

The numerical model by Chang and Blume (1998) uses this method to describe 
the behaviour of water on deck when depth is small. For larger depths of water on 
deck or higher roll angles, employs another method has to be employed, consisting 
of assuming that the free surface is plane but not horizontal. The Lagrange equation 
is used to obtain an equation of the motion of the free surface, which is solved in 
the time domain using the Runge-Kutta method. 


5.5.4.3 Modeling Progressive Flooding 


Progressive flooding refers to the flow of water between different compartments 
through non-watertight openings. This flow continues until a state of equilibrium is 
reached or sinking/capsize occurs. During this flow, the ship is subject to the so- 
called transient flooding and is said to be at intermediate stages of flooding (using 
the IMO terminology). This phase of flooding is generally not considered when the 
survivability of the ship in damaged condition is addressed, since this is generally 
assessed only for the final damaged condition. However, as a ship might capsize 
during transient flooding conditions, some provisions for checking her stability at 
intermediate stages of flooding are taken in SOLAS. 

Numerical models of the dynamic behaviour of damaged ships are generally not 
adapted to deal with complex progressive flooding situations of multiple 
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compartments, especially under the action of waves. An exception is the modelling 
of the flooding of asymmetric spaces, such as cross-connected side compartments. 
This type of arrangements is common in passenger Ro-Ro ships and its effects have 
been studied by De Kat (2000) using hydraulic models for reproducing the flow 
characteristics. The studies of Vermeer et al. (1994), Van’t Veer and De Kat (2000) 
and Xia et al. (1999) also present numerical and experimental results regarding the 
same type of problems. In later works, apart from the simulation of the flow through 
ducts, effects of air compression and trapping in the flooded compartments are also 
modelled using the thermodynamic laws for gases. Recently, Ruponen (2007) de- 
veloped a similar numerical model for calculating progressive flooding in complex 
subdivision arrangements in calm waters, taking into account air trapping and com- 
pression. 

Van’t Veer et al. (2002) have studied the progressive flooding of passenger spaces 
onboard a cruise ship with the objective of calculating the ship’s time to sink or 
capsize in a certain seaway. Santos et al. (2002) applied a similar numerical model 
to the study of the flooding of the machinery spaces of a passenger Ro-Ro ship 
which suffered an accident and capsized. 

These studies have been conducted mainly for passenger ships, but warship pro- 
gressive flooding has also been considered by Palazzi and De Kat (2003), who stud- 
ied the effects of cross-flooding arrangements in the dynamic behaviour of a dam- 
aged frigate in regular and irregular seas. 


5.5.5 Benchmark Studies 


The numerical methods described above have been evaluated within the scope of 
benchmark studies organised by the Specialist Committee on Extreme Motions and 
Capsize (now Committee on Stability in Waves) of ITTC. These studies have fo- 
cused on the assessment of the survivability of damaged passenger ships, especially 
Ro-Ro ships, in waves. The main objective is to assess existing methods and tools 
regarding its capability to predict accurately damaged ship survivability. 

The first conducted ITTC benchmark study, reported by Papanikolaou (2001), al- 
lowed first some conclusions regarding intact ship dynamics, namely that roll decay 
tests and intact ship responses in waves, even if extreme waves are considered, can 
be accurately predicted, although some deviations in the resonance region were no- 
ticed due to insufficiencies in the used semi-empirical roll damping models. In what 
concerns damaged ship motions, inconsistencies were found when simulating roll 
decay, roll natural period and roll damping in damage condition. This indicates a 
lack of proper modelling of damage ship hydrodynamics and of the flooding effects 
(inflow/outflow and floodwater dynamics). The simulated time series of motions in 
irregular waves indicate. substantial differences between numerical and experimen- 
tal results, which result from inaccuracies in the calculation of hydrostatic proper- 
ties of the ship and in the calculation of the exciting irregular seaway. However, as 
shown in Fig. 5.21, most participants of the benchmark study could predict with 
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ITTC Bechmark Study Dec, 2001 
Survive/Capsize Boundaries 


Participant 
Fig. 5.21 Survival boundaries (Papanikolaou 2001) 


good precision the survival/capsize boundaries and critical seastates of the bench- 
mark Ro-Ro ship by using various numerical simulation models. 

Building upon knowledge gained in the first benchmark study, a second study 
was conducted by Papanikolaou and Spanos (2004) on behalf of ITTC aiming at 
providing more in depth comparative information about the basic features of the 
numerical methods when applied to the simulation of the behaviour of the dam- 
aged ship in calm waters. The numerical methods results regarding the roll natural 
period show some scattering although the overall modelling of inertia and restor- 
ing forces was found to be satisfactory. The methods are highly sensitive to inac- 
curacies in roll damping prediction even in calm waters. At present, experimental 
data for determining semi-empirical roll damping coefficients seems necessary for 
all numerical codes. Regarding the dynamics of a tanker with a partially flooded 
compartment, it was concluded that numerical methods that consider the floodwater 
having its free surface continuously horizontal cannot capture the floodwater dy- 
namics properly. Finally, the simulation of roll decay of a passenger Ro-Ro ship 
during transient flooding showed the importance of employed hydraulic coefficients 
for the simulated results. 

Within the framework of SAFEDOR, as reported by Papanikolaou and Spanos 
(2008), a further benchmark study on the accuracy of the numerical codes in the 
prediction of damaged ship survivability in waves was carried out, complementing 
past and related benchmark studies of ITTC. 

The numerical estimates on survivability of the damaged ship were found to be 
sensitive with respect to the periods of the incident waves, while less sensitive with 
respect to the assumptions for the discharge coefficients and ship loading condition. 
No conclusions could be derived for the effect of the viscous roll damping, while the 
present results seem to contradict conclusions from earlier benchmark studies, sug- 
gesting an increased importance for the values of the semi-empirical roll damping 
coefficients. 
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Table 5.8 Survival boundaries 


Participant Ay. ‘suey Mean Diff. from Exp 
mean 

Pl 3.23 +0.23 

P2 1.75 —1.25 

P3 4.00 3.00 +£1.00 <3.00m 

p4 3.00 +0.00 


The aggregate performance of the benchmarked codes appears divergent. Esti- 
mates for the survive boundary could deviate up to 1.0m, compared to model ex- 
periments, which is quite high, while the codes have partly predicted opposite trends 
with respect to variations of basic parameters. Even for the codes that appear to be 
very accurately predicting the survival boundary (2 codes out of 4), it was found that 
they are characterized by a substantially different performance in the background 
(Table 5.8). 

Studies on numerical methods have recently focused on the time-to-flood. Ac- 
cordingly, a 3rd ITTC benchmark study was conducted in 2006, as reported by van 
Walree (2007). The objective of this benchmark study was to establish current ca- 
pability and weaknesses in predicting, qualitatively and quantitatively, the time-to- 
flood for a quite complex configuration of compartments in a barge-like hull form. 
Experimental results from Ruponen et al. (2006) were used to validate the numerical 
codes regarding time-to-flood, motions and flooded volumes in compartments. 

A typical result regarding the flooding of an upper deck compartment (“up- 
flooded” from a lower compartment) is shown in Fig. 5.22. Overall it can be stated 
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Fig. 5.22, Numerical and experimental levels of water in flooded compartment 
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that the steady state condition of all conducted tests was reasonably well predicted 
by the codes. The prediction of the flooding rates and transient phenomena was, 
however, less satisfactory. Reasonable time to sink predictions appear feasible, al- 
though with some uncertainty, by present numerical codes, for calm water condi- 
tions. However, their performance in waves still has to be evaluated. 


5.5.6 Summary 


A review of the open literature indicates that there are very few mature numerical 
models and tools for assessing damaged ship behaviour in waves available today. 

The University of Glasgow and Strathclyde has developed and validated the code 
PROTEUS, mainly for passenger Ro-Ro ships and cruise vessels, which is available 
in different versions according to the type of application envisaged. There are ver- 
sions of this code which consider three degrees or all six degrees of freedom and 
different modelling of floodwater behaviour. 

The National Technical University of Athens has developed the code CAPSIM 
which includes all six degree of freedom; this code has been validated for passenger 
Ro-Ro ships, naval ships and fishing vessels. The same code may be applied to the 
assessment of ship’s intact stability in waves. 

MARIN disposes also its own numerical model, namely FREDYN, which is ca- 
pable of describing the dynamics of damaged ships. This tool is also capable of eval- 
uating the coupled manouvering and seakeeping performance of intact or damaged 
ships in various headings and has been validated mainly for naval and Ro-Ro ships. 

HSVA has also developed in collaboration with the University of Hamburg a 
numerical model, namely the code ROLLS, which is also able to evaluate damaged 
ship dynamics. This tool calculates roll and surge motions in the time domain and 
the other motions in the frequency domain. It has been applied extensively in the 
evaluation of damaged passenger Ro-Ro ships. 

Finally, Instituto Superior Técnico has also developed its own numerical model 
capable of simulating damaged ship motions in waves, progressive flooding and 
water on deck effects. 

Closing, it should be noted that in the framework of project SAFEDOR some 
simplified but fast methods and tools have been developed for the probabilistic 
assessment of flooding and its effects on ship’s damage stability and floatability. 
These methods and tools are elaborated and demonstrated in Chap. 6, Sect. 6.3 and 
Chap. 2, Sects. 2.1 and 2.2. 
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5.6 Fire 


5.6.1 Introduction 


Fire is a very serious hazard both to people and cargo onboard a vessel. Therefore, 
a fire safety assessment is essential in risk-based ship design. A variety of methods 
are available for such an assessment along with the support by empirical data related 
to the vulnerability of humans exposed to fire and the associated smoke. 

In principle, a numerical simulation of the generation and evolution of a fire and 
smoke movement can be performed using Computational Fluid Mechanics (CFD), 
e.g. ANSYS-CFX. However, all the input data needed are seldom at hand and, fur- 
thermore, the computational effort is enormous if more than just one single com- 
partment or unit is to be considered. Therefore other more approximate methods, 
like the so-called zone methods, have been developed able to capture the qualitative 
behaviour of the evolution of a fire. 

In the following a short outline of some of the methods dealing with the pre- 
diction of fire evolution will be given, illustrated by a few specific fire scenarios 
applications. Some of the main results and conclusions will be presented. 


5.6.2 Fire in Containers and Cargo Space 


In terms of cargo fire safety, a quantitative risk model for cargo fires has been de- 
veloped, Povel et al. (2008). The model used fire engineering calculation results 
and Bayesian probabilistic modelling. Following from a Qualitative Design Review, 
which includes hazard identification (HAZID) according to the guidelines given 
by IMO, a fire scenario inside a closed cargo hold of a container vessel has been 
evaluated. 

A representative vessel design (2500 TEU) was used as case study where pre- 
scriptive (according to currently available rules) fire protection measures were 
adopted. These measures, referred to as risk control options (RCOs), include mea- 
sures such as improved container designs with better sealing and better thermal re- 
sistance/properties, fire detection systems for containers, advanced fire detection for 
cargo holds, as well as different automatic and manual fire extinguishing measures. 

The development of a risk prediction model for cargo fires integrates two major 
parts. The first part comprises detailed CFD calculations and provides essential data 
of the fire development inside a 40 ft container as well as the fire spread in a cargo 
hold. These calculations were carried out using the ANSYS CFX software. 

For the second part a model has been developed that addresses the quantification 
of risk by determining the probability of consequences resulting from defined fire 
scenarios. This was achieved by using the Bayesian Network modelling technique 
by use of the HUGIN software. 
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5.6.2.1 Fire Simulations 


To represent a 40 ft container, the corresponding geometric model is 12m long, 
2.35 m wide and 2.4m high. The container boundary has openings to represent the 
side vents as well as possible gaps around the doors and between the floor panels. 
The cargo is modelled as a set of boxes, each 1.2 m long, 0.8 m wide, 1.6m high and 
raised 20cm above the floor to simulate the air gap associated with the pallet that 
the cargo sits on. The gap between the cargo boxes was set to be 10cm. 

In the real container, the side vents are composed of a 2 x 5 grid of 9 mm diameter 
holes. These are represented in the CFD model by a single rectangular hole having 
the same total area of the holes and the aspect ratio of the grid. In the real container 
the gaps around the doors are composed of a narrow continuous horizontal slot at 
the top and bottom of the container frame and a vertical slot down the middle where 
the two doors meet. To reduce the number of nodes in the mesh the door gaps were 
modelled as a line of square holes such that the total area is the same as a continuous 
2mm wide gap. Similarly, the container floor is composed of panels with gaps of 
approximately 2mm between them and these were represented in the CFD model 
as 3 square holes for each gap having the same total area. The modelling of the gaps 
around the door and between the floor panels is based on a conservative assumption 
for the air leakage of the container sealing. The leak areas are small but it has been 
shown previously that leakages can have a major effect on under-ventilated fires, and 
this is why they have been represented explicitly. The mesh consisted of 105,979 
nodes and 336,229 volume elements. The mesh was inflated off all the walls using 
3 inflation layers with the first layer height being set to 5mm. 

The fluid in the container was considered to be a combusting mixture of methane 
and oxygen as the fuel and oxidant and water and carbon dioxide as the combustion 
products (plus nitrogen as an inert component). All the openings (door gaps, floor 
gaps, side vents) were modeled as a pressure boundary having a default atmospheric 
pressure. The heat loss from the metal walls of the container was modeled with an 
external heat transfer coefficient of 5kW/(m?K). The wooden floor was set to have 
a fixed temperature of 20°C. 

The effect of pyrolysis was modeled by keeping track of the temperature of all 
surface elements on the cargo. When the temperature exceeded a user specified criti- 
cal value, in this case 500 K, a source of methane was applied to the surface element 
at a constant mass rate, which represented an equivalent fixed heat release rate for 
a fixed length of time such that the total amount of methane released reflected the 
estimated heat content of the cargo. An ignition source was simulated by turning on 
pyrolysis at the bottom corner of the cargo near the door. 

An exploratory transient analysis has been performed with a total simulation time 
of 10 min. In this simulation the time step quickly attained the maximum allowed 
value of 0.5 s during the initial heating phase, was reduced to 0.05 s during the rapid 
fire spread phase and rose back to 0.5 s after the fire stopped spreading. Some results 
for the temperature distributions are shown in Fig. 5.23. 

The above figures also show an iso-surface of temperature at 500 K, coloured 
grey. The cargo with the ignition source slowly heats up to the pyrolysis temperature 
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Fig. 5.23 The temperature on the cargo at 200s (top) and 250s (bottom) 
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along its exposed vertical corner resulting in more methane being released. At the 
same time a plume of hot gas spreads along the roof heating the top of the cargo 
blocks. At 250 s the top of the cargo blocks is close to the pyrolysis temperature and 
as a result, flame spread occurs rapidly across the top of the cargo blocks over the 
next 20s. After this time the level of combustion diminishes, despite the continuing 
supply of fuel, due to the diminishing amount of available oxygen. At 300s all of 
the oxygen has been consumed and the cargo blocks begin to cool. 

In reality, it is expected that pyrolysis will be reduced as the concentration of 
methane in the container increases, thus allowing fresh air to enter the container. 
Under such a pyrolysis model, one of two possible burning modes is likely: A steady 
state mode representing a smouldering fire with a low pyrolysis rate and a contin- 
uous supply of air, or a mode in which the pyrolysis rate oscillates about a mean 
value. In either event, the maximum external surface temperature is unlikely to be 
greater than in the current simulation. More details can be found in Povel et al. 
(2008). 


5.6.2.2 Bayesian Risk Model for Cargo Fire 


In order to quantify the risk associated to cargo fires a model has been developed, 
Povel et al. (2008), determining the probability of a particular outcome that has 
been identified by the HAZID and being influenced by several prescriptive and addi- 
tional risk control measures. Prescriptive measures are based on SOLAS regulations 
and classification guidelines, whereas additional measures arise from innovative and 
novel designs. Using this model it is possible to quantify the impact of these mea- 
sures on risk. Various modelling techniques can be applied to assess the risk and 
Event Trees and Fault Trees, or the combination of both complementary methods, 
are the most common approaches. Unfortunately, both techniques have their disad- 
vantages, since incidents are modeled as a sequence of specific events, in which it 
is difficult to represent the state of the system and the environment being analyzed. 
Furthermore, much effort has to be spent in order to include conditional dependen- 
cies into tree structures. Therefore, in the last years, Bayesian Networks, which are 
a familiar approach for modeling expert systems, is becoming popular also in safety 
applications. Since their formulation is more generic it is possible to convert any 
Event Tree or Fault Tree to a Bayesian Network. 

The nodes in a Bayesian Network, representing either a certain event or a condi- 
tion of the system, can have an arbitrary number of states, which can be distributed 
based on probability. A directed arc connecting two nodes symbolizes an influence 
of the states of one node on the distribution of the states of the other node. That 
means, for every node the number of probability distributions corresponds to the 
number of states of its parent nodes (or the combination of the states if there is more 
than one parent node). 

To describe a cargo fire by means of a Bayesian Network first the fire incident 
itself has to be analyzed in order to identify possible scenarios with essential prob- 
abilistic parameters, which can be represented by nodes. 
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In the model discussed here it has been assumed that the fire will grow from the 
ignition inside a single container to a fire that affects more than one cargo hold. 
Therefore, the fire is separated into four particular fire stages based on the number 
of containers being affected and whether damages to the vessel structure will occur. 
Every fire stage relates to a consequence, namely, “minor damage”, “major dam- 
age’’, “hazardous consequences” and “catastrophic consequences”. The probability 
of suppression or containment of a fire in certain stage is influenced by various other 
parameters, such as fire fighting measures that can be undertaken. In order to exem- 
plify the dependencies in the network a part of the model that represents the first 
stage (fire inside a single container) is shown in Fig. 5.24. 

In order to demonstrate the conditional probabilities or dependencies in the net- 
work one can look at the node “Fire Spread of Goods”. This node can have states 
such as “Very Fast’, “Fast”, “Moderate”, etc. These states are distributed on prob- 
abilities based on experience. In case of an ignition inside a container the fire de- 
velopment is strongly dependent on the goods that are transported and their class of 
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Fig. 5.24 Bayesian Network representing a fire in one container 
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fire spread. Apparently both, the probability of self extinction and the time available 
for fire fighting until fire spread to adjacent containers occurs, will be influenced 
as well. 

The Bayesian Network presented is only a simplified representation of the real 
scenarios, but it can help understanding and quantifying the influence of different 
risk control options (RCOs). The impact of a particular option can be determined by 
using a procedure that is called “Observed Evidence”. In the context of risk control 
options it means that certain options, such as detection or fighting measures, can 
be either accounted or dismissed for the analysis by assigning the nodes represent- 
ing a particular RCO a predefined state, rather than complying with a probability 
distribution. Thus, the direct influence of a particular Risk Control Option can be 
evaluated. 

The main work when using a Bayesian Network is filling the probability tables 
of the nodes being influenced by each other. This information can be obtained from 
expert judgments, statistic evaluations, as well as from Fault Tree analyses. 

Results from CFD simulations inside a container as well as inside a cargo area 
were used as an essential input to the Bayesian Network model since they deliver 
important characteristics having an effect on risk. From temporal and local param- 
eters such as the development of fire spread and time lines for heat and thermal 
radiation not only the consequences for the transported cargo and vessel structure 
can be derived but also the response time of fire detection systems as well as the fire 
fighting measures can be obtained. Furthermore, the influence of risk control options 
on the above-mentioned parameters can be quantified and their costs effectiveness 
estimated. 

By looking at the incident frequency of occurrence needed for “Break Even”, 
which is the frequency when expenses for the additional RCO pay off, only three 
of the options are interesting. These are “Improved Detection in Hold”, “Improved 
CO System” and “HiExFoam System”, as shown in Fig. 5.25. It must be said that 
these results should be interpreted with care due to the large number of made as- 
sumptions. 

The work carried out in Povel et al. (2008) led to the following main conclusions: 


e Although CFD modelling proved very useful in gaining insight, the overall level 
of understanding about the fire progression inside containers and into the hold as 
well as the effectiveness of fire suppression options is still insufficient for proper 
quantification of the consequences, and hence of the risk. 

e Very little information is available about fire ignition inside containers. This 
makes it difficult to address the probability modelling of ignition. 


Given the various uncertainties and the lack of understanding associated with fire 
progression and suppression in cargo areas a general quantification covering a top- 
level scenario at the current stage is impossible. Thus, although the benefit from the 
developed model can be considered to be the introduced methodical approach to the 
problem, a more qualitative approach might have been more useful. 
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Fig. 5.25 Incident frequencies of occurrence required for pay-off of different RCOs 


5.6.3 Fire Risk Analysis — Human Life 


Following a Qualitative Design Review (QRD), the work on a Quantitative Risk 
Analysis (QRA) framework that could be used during concept design stages can 
be initiated. The following elements have been addressed: The probability of igni- 
tion in a particular space of the ship (pjgn), the probability of escalation (pesc) and, 
the severity of the consequences of a serious fire event and the expected number 
of injuries or fatalities (pj) was estimated. This approach can be adopted for the 
quantification of risk to human life in terms of the risk acceptance criteria proposed 
in the form of individual risk and FN curves. The main principles are illustrated in 
Figs. 5.26 and 5.27. 

Work on the ignition and escalation models is still needed. In relation to the 
consequence analyses, the developments relate to an engineering tool to address the 
escalation and fire/smoke impact on occupants for specific scenarios, reported as 
follows: 


e Modelling the environment insofar as it is relevant to the scenario. 

e Spread simulators, e.g. fire/smoke propagation models, progressive flooding 
models, toxic gas diffusion models and water supply line contamination 
models. 

e Occupant mobilization simulator, i.e. a model of crowd flow that can be con- 
trolled and programmed to follow any desired operation involving the shipboard 
occupants. 
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Fig. 5.27 The three main probabilities needed for a fire QRA 


e Numerical model of the effect of the detriments, e.g. floodwater, smoke, heat, 
toxicity on the occupants. 


A software platform where the above models are integrated has been used in the 
SAFEDOR project to evaluate the severity of consequences in specific fire scenar- 
ios. The principle of QRA has been illustrated with a case study of a main vertical 
zone (MVZ) of a typical large cruise vessel. Two scenarios including passenger ac- 
commodation and public spaces were evaluated for a SOLAS design (regarding the 
maximum size of a MVZ) and for an alternative design featuring a MVZ larger than 
the current SOLAS limit. The necessary fire engineering calculations were carried 
out using both a field (CFD) and a zone model, see Fig. 5.28. These analyses have 
been used to evaluate the risk to human life in terms of the number of occupants 
affected by the fire hazards (mainly smoke). Selected results from the CFD model 
are shown in Figs. 5.29, 5.30 and 5.31. 
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Fig. 5.28 Sample of results for passenger cabin fire scenario (top: SSRC zone and escape model) 
and public space fire scenario (bottom: ANSYS/CFX field model) 
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Fig. 5.30 Temperatures at 260s and 1.5 m from the floor: /eft Deck 6, and right Deck 7 


A non-structured numerical grid was built for the simulation. The grid contains 
26,469 nodes that form 119,935 tetrahedral elements. Around the source, the mesh 
was locally refined and the mesh spacing reduced to approximately 25cm. High 
resolution numerical scheme was used for mass, momentum and energy transport 
equations, whereas for the k and € transport equations, an upwind scheme was se- 


lected to improve convergence. 


Radiation intensities were calculated on a coarser mesh, which was obtained 
by joining 64 adjacent control volumes. For each of these volumes, the radiation 
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Fig. 5.31 Soot at 260s and 1.5 m from the floor: left Deck 6, and right Deck 7 


contribution was calculated from 24 rays in each angular direction. Particle injec- 
tion frequency of a sprinkler was 10s~! 

The numerical simulation covered 1700s of a real time fire scenario and it was 
performed in two parts. After the initial 360s, when the doors are open, the simula- 
tion was stopped. The setup was changed to model the closed-door scenario. Then 
the simulation continued using previous results for the initial conditions. 

Figure 5.29 presents the air velocity field. Velocities are high around the heat 
source and in stairways, where sprays and opening boundary conditions generate 
significant draft. Locally, each sprinkler separately induces a significant downward 
air movement due to entrainment, which is manifested as a local velocity peak. 

Figure 5.30 shows temperature distribution 1.5 m above the floor on Deck 6 and 
on Deck 7. The simulation results show that at this level almost half of the Deck 6 
is affected by a temperature rise, although only 10% of the area reaches temperature 
above 350 K. The Deck 7 temperature is unaffected. This indicates that the layer of 
hot gases is thinner on both decks and do not reach 1.5 m level except close to the 
source, where it is affected by a rising plume from the fire. 

Figure 5.31 shows mass fractions of soot (C) determined from composition 
ratios. 

The conclusions reached from the above results and the related analysis can be 
summarised as follows: 


e Quantitative risk analysis using results from numerical models is a sound ap- 
proach to evaluate the fire safety of novel designs. 

e On the other hand the number of occupants affected by fire/smoke in particular 
scenarios is a strong function of the peak values of toxicity and temperature en- 
countered by the occupants. This indicates that the fatality count so computed 
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should not be taken at face value, at least at the current stage of the predictive 
technology. 

e The fatality count does, however, give a good insight and a reasonable figure for 
comparison between scenarios and between design alternatives. 

e There is a need for standardization of fire-loss and fire risk calculation proce- 
dures. A standard procedure will ensure that the results computed independently 
by different analysts and simulation tools would numerically agree. 


Another challenge faced in quantitative fire risk analysis is that of inadequacy of 
the available product model. In the present context, the spatial distribution of the 
combustibles along with their combustion related properties (e.g. ignition tempera- 
ture, calorific content, chemical species content etc.) should be a part of the product 
model for fire-safety analysis. The thermal properties of walls, bulkheads, linings 
etc. should also be a part of the product model. Currently the information about 
these aspects is not formally available in the ship product models. A standardization 
effort should be directed to enforce creation and maintenance of the product model 
that satisfies the information requirements of fire safety analysis. 
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5.7 Intact Stability 


5.7.1 Introduction 


Large roll motion of ships can lead to various types of failures ranging from sea- 
sickness over cargo shift and loss of containers to capsize of the vessel. Hence, it 
is important to minimise the roll motion during a voyage. Currently, on-board de- 
cision support systems, e.g. Rathje (2005), Nielsen et al. (2006) and Spanos et al. 
(2008), are being installed in vessels with the aim to provide the officer on watch 
with guidance on the best possible route, taking into account the weather forecast, 
the time constraints for the voyage and the limiting criteria for motions, accelera- 
tions and loads. 

A main problem is real-time estimation of the sea state. Here two approaches 
are being tested in full scale. The first is based on the use of a wave radar, e.g. the 
WAVEX system, see Borge et al. (2000), and the second uses ship responses (e.g. 
motions, accelerations and strains) measured in real-time by sensors installed on 
board together with linear transfer functions to estimate the sea state, see Nielsen 
(2006), where a comparison between the two approaches is also found. 

After estimation of the sea state, a real-time estimation of the maximum ship 
responses within the next few hours as function of ship speed and course is needed 
to guide the officer on the action to take if excessive responses are foreseen with 
the present course and speed. To linear responses the standard frequency domain 
approach using transfer functions can easily be applied. For non-linear responses, 
to which extreme roll motions belong, mostly nonlinear or quasi-nonlinear time 
domain simulations are employed to obtain related short-term statistics, e.g. Kriiger 
et al. (2004), Daalen et al. (2005) and Spanos and Papanikolaou (2005). However, 
less time-consuming stochastic procedures have also been suggested. Most of them 
are based on simplifying, but quite reasonable assumptions, like equivalent linear 
damping, e.g. Bulian and Francescutto (2004), second- or third-order perturbation 
procedures, e.g. Neves and Rodriquez (2005), Melnikov functions, e.g. Hsieh et al. 
(1994) and Spyrou (2000) and moment closure techniques, Ness et al. (1989). More 
recently, different procedures based on the identification of critical wave episodes 
related to the roll motion have been suggested; see Spyrou and Themelis (2006), 
Jensen and Pedersen (2006) and Jensen (2007). The present account is largely based 
on Jensen (2007). 


5.7.2 Roll Motion of a Ship 


Comprehensive reviews of theoretical-numerical and experimental methods dealing 
with ship’s intact stability can be found in recent reports of the Specialists Com- 
mittee on Stability of Ships in Waves of ITTC, de Kat (2005). The report by de Kat 
(2005) discusses various modes of failure, i.e. capsize and the prediction procedures 
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available. The report is partly based on results of a questionnaire distributed to a 
large number of organisations and thus reflects very well the current status. To cover 
all modes of failure (static loss of stability, parametric excitation, dynamic rolling, 
resonance excitation and broaching) a non-linear six-degrees-of-freedom time do- 
main simulation procedure that includes viscous effects and manoeuvring models 
must be applied. Some commercial codes, e.g. LAMP, France et al. (2003) and Shin 
et al. (2004), seem to be able to produce valuable results with reasonable accuracy, 
but they are very time-consuming to run, restricting the application to regular waves 
or very short stochastic realisations. 

Another non-linear six degrees of freedom simulation procedure is GL-SIMPEL, 
see e.g. Pereira (1988) that is based on a non-linear strip theory formulation. The 
frequency dependence of the added mass and damping is taken into account using a 
higher differential equation formulation. FREDYN, see e.g. France et al. (2003), is 
another non-linear code based on a strip theory formulation. Generally, these codes 
are much faster than non-linear three-dimensional procedures like LAMP and, as 
the three-dimensional effects on the roll motion is usually not that important, to be 
preferred for design work and onboard decision support system. 

Other procedures have more limiting capabilities as some of the capsize modes 
are excluded. An example is the ROLLS procedure, Kroger (1986), where the fol- 
lowing non-linear differential equation is used to estimate the roll angle ¢, (omitting 
the terms due to wind and fluids in tanks): 


g — Mat My —Ma~ Ale—W)GZ(9) — hal(6 +09") sing — (V+ vo") cosg] 


Lex —L,(ysing + 8 cos) 
(5.23) 


Here My, Msy and Mj are the roll moments due to waves, sway and yaw, and 
hydrodynamic damping, respectively. Furthermore, J, and /,, are the mass moment 
of inertia about the longitudinal axis and the cross term mass moment of inertia. 
The displacement of the ship is denoted by A and g is the acceleration of gravity. 
The instantaneous value of the righting arm GZ is in irregular waves calculated ap- 
proximately using the so-called Grim’s effective wave. The heave w, pitch 8 and 
yaw y motions are determined by standard strip theory formulations, whereas the 
surge motion is calculated from the incident wave pressure distribution. The advan- 
tage of this formulation compared to full non-linear calculations is the much faster 
computational speed, still retaining a coupling between all six- degrees-of-freedom, 
Kriiger et al. (2004). The model can, however, not deal with broaching due to the as- 
sumption of a linear yaw motion. Both the ROLLS and the GL-SIMBEL procedures 
are described and validated in the IMO-SLF submission by Germany (2007). 

Here a simplified version of Eq. (5.23) is considered. Both the heave motion w 
and the wave-induced roll moment Mg are taken to be linear functions of the wave 
elevation, and some closed-form expressions given by Jensen et al. (2004) are ap- 
plied. The cross term mass moment of inertia is assumed to be small, and pitch is 
thus only included through the static balancing of the vessel in waves in the calcula- 
tion of the GZ curve. Furthermore, the sway, yaw and surge motions are ignored as 
the vertical motions have the largest influence on the instantaneous GZ curve. The 
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damping term Mj is modelled by a standard combination of a linear, a quadratic and 
a cubic variation in the roll velocity. With these simplifications Eq. (5.23) reads 


B3b? — (g—w)GZ() | Mo 
(00) 


@ = —2B a9 — Brd|| + 


r 2 Lex 


(5.24) 


where r, is the roll radius of gyration. The roll frequency @¢ is given by the meta- 
centric height GM,,, in still water: 


ee (5.25) 
rs 

It is clear that this model is very simplistic, but it is well suited to illustrate 
the proposed stochastic procedure as it can model parametric rolling, resonance 
excitation and forced rolling. Hence, it is possible to identify which mode is the 
most probable for a given combination of sea state, speed and heading. As broaching 
and dynamic rolling (where a strong coupling to surge exists) cannot be modelled 
by Eq. (5.25) following and stern quartering seas will be excluded from the present 
analysis and only heading angles y in the range from 60 to 180 degrees (head sea) 
will be considered. 

The instantaneous GZ curve in irregular waves will here be estimated from nu- 
merical results for a regular wave with a wavelength equal to the length L of the 
vessel and a wave height equal to 0.05L. These numerical results are fitted with 
analytical approximations of the form 


GZ(o, xc) = (Cosing +Cig + C39? +Cso*) cos* (=) + 


(5.26) 
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é. 
where the wave crest position x, is measured relative to the aft end of the vessel. 
Similarly, the GZ curve in still water is fitted by 


GZsw(@) = (GMgy — Ai) sing +A1 6 +A36° +A56° (5.27) 


The coefficients (A;,A3,A5,Co,C1,C3,Cs,Do,D1,D3,Ds,L.) in Eqs. (5.26) 
and (5.27) are found by the least square method. Other polynomial or Fourier se- 
ries representations have been suggested, e.g. Spyrou (2000) and Bulian (2005), and 
generally a very good fit can be achieved for the range of roll angles of interest. 

In a stochastic seaway the following approximation of the instantaneous value of 
the righting arm GZ(t) is then applied: 


h(t) 


GZ(9,t) = GZyw(@) + 0.05L 


(GZ, xe(t)) — GZsw (b)) (5.28) 


The instantaneous wave height h(t) along the length of the vessel and the position 
of the crest x, are determined by an equivalent wave procedure somewhat similar to 
the one used by Kroger (1986): 
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(5.29) 


Note than in beam sea h(t) = 0 such that GZ(@,t) = GZs,(). Stationary sea 
conditions are assumed and specified by a JONSWAP wave spectrum with signifi- 
cant wave height H, and zero-crossing period T,. The frequency range is taken to be 
m < wT, < 3m covering the main part of the JONSWAP spectrum. 

The next step in the solution procedure is to account for the stochastic behav- 
ior of the sea. The straight forward procedure is to generate time series of random 
waves and use them as input to the ship motion code and then extract extreme val- 
ues by simple counting and subsequent fitting to a proper extreme value distribution, 
e.g. the Gumbel distribution. This, however, requires long simulation time and also 
CPU time to get sufficiently reliable results. A solution is to use clusters of com- 
puters. Other methods seek to identify the most probable wave episodes leading to 
a specified large roll angle. Spyrou and Themelis (2006) describe such an approach 
in which a specific ship motion parameter, e.g. a large roll angle, is calculated for 
a range of wave heights, wave periods and number of adjacent high waves. There- 
after, the probabilities of encountering these wave groups are determined and used to 
estimate the corresponding probability of exceeding the prescribed ship motion re- 
sponse. The feasibility of the method has been documented in Spyrou and Themelis 
(2006) and Themelis et al. (2007). 

A related procedure for the calculation of exceedance probabilities and associ- 
ated critical wave episodes has been developed in Jensen and Pedersen (2006) for 
parametric roll in head sea and extended in Jensen (2007) to cover other types of roll 
motions. This procedure uses the First-Order Reliability Method (FORM) to deter- 
mine the mean out-crossing rate of the ship response considered. The procedure also 
identifies a design point with a corresponding most probably wave episode leading 
to the prescribed response value. Thereby, the tedious task to identify critical wave 
episodes is done automatically by the procedure and the user (i.e. the designer) only 
has to select or program a proper time-domain procedure able to model the ship 
response in question. All the statistical estimates are then done within a standard 
First-Order Reliability Method (FORM). In the present treatment, the time domain 
simulation routine, Eq. (5.24), has been linked to the FORM software of PROBAN 
(Det Norske Veritas 2003). It is clear that Eq. (5.24) has a rather limited accuracy, 
but anyway contains the main features needed to model parametric rolling, roll res- 
onance in near beam sea and forced roll. It is straightforward to replace Eq. (5.24) 
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with e.g. Eq. (5.23). The FORM procedure has also been applied recently in a con- 
cept for an onboard decision support system, Spanos et al. (2008). 

In the following, the FORM procedure is first described in general terms and then 
results for a container ship are presented and discussed. 


5.7.3 First-Order Reliability Method Applied Wave Loads 


5.7.3.1 Design Point and Reliability Index 


In the First-Order Reliability Method (FORM), the excitation or input process is a 
stationary stochastic process. Considering in general wave loads on marine struc- 
tures, the input process is the wave elevation and the associated wave kinemat- 
ics. For moderate sea states the wave elevation can be considered as Gaussian dis- 
tributed, whereas for severer wave conditions corrections for non-linearities must be 
incorporated. Such corrections are discussed and accounted for by using a second- 
order wave theory in a FORM analysis of a jack-up platform Jensen and Pedersen 
(2006). In the present paper dealing with the roll motion of a ship, linear, long- 
crested waves are assumed and hence the normal distributed wave elevation H(X,t) 
as a function of space X and time ¢ can be written 


H(X,t) = ¥, (wici(X,t) + wi64(X,t)) (5.30) 
i=1 


where the variables u;,i#; are uncorrelated, standard normal distributed variables to 
be determined by the stochastic procedure and with the deterministic coefficients 
given by 

ci(x,t) = 0; cos( at — kX) 

éj(x,t) =-0O; sin( @jt —k;X) (5.31) 


o? = S(a@)da; 


L 


where @;, kj = wo? /g are the n discrete frequencies and wave numbers applied. Fur- 
thermore, S(@) is the wave spectrum and dq; the increment between the discrete 
frequencies. It is easily seen that the expected value E[H7] = [ S(w)daq, thus the 
wave energy in the stationary sea is preserved. Short-crested waves could be incor- 
porated, if needed, but require more unknown variables uj, ij. 

From the wave elevation, Eqs. (5.30) and (5.31), and the associated wave kine- 
matics, any non-linear wave-induced response @(t) of a marine structure can in prin- 
ciple be determined by a time domain analysis using a proper hydrodynamic model: 


@ = O(t |, ,1, U2, i2,...,Un, tin) (5.32) 


Each of these realisations represents the response for a possible wave scenario. 
The realisation which exceeds a given threshold @¢g at time t = fg with the highest 
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probability is sought. This problem can be formulated as a limit state problem, well- 
known within time-invariant reliability theory (Der Kiureghian 2000): 


g(U1, i), U2, i, aah ,Un, Un) = go — 6 (to \uy »U,,U2,U2,. or ,Un, Hn) = 0 (5.33) 


An approximate solution can be obtained by use of the First-Order Reliability 
Method (FORM). The limit state surface g is given in terms of the uncorrelated 
standard normal distributed variables {u;, i;}, and hence determination of the design 
point {u*,i*}, defined as the point on the failure surface g = 0 with the shortest 
distance to the origin, is rather straightforward. A linearization around this point 
replaces Eq. (5.33) with a hyperplane in 2n space. The distance Brorm 


n 


Brorm =min,/ > (u? +a) (5.34) 
i=1 


from the hyperplane to the origin is denoted the (FORM) reliability index. The cal- 
culation of the design point {u*, i; } and the associated value of Brorm can be per- 
formed by standard reliability codes (e.g. PROBAN, Det Norske Veritas 2003). Al- 
ternatively, standard optimisation codes using Eq. (5.34) as the objective function 
and Eq. (5.33) as the constraint can be applied. 

The integration in Eq. (5.33) must cover a sufficient time period {0,to} to avoid 
any influence on @(to) of the initial conditions at t = 0, ie. to be longer than the 
memory in the system. Proper values of tg would usually be 1—3 minutes, depending 
on the damping in the system. Hence, to avoid repetition in the wave system and for 
accurate representation of typical wave spectra n = 15-50 would be needed. 


The deterministic wave profile 


H*(X.i)= 3 (u*c)(X,t) + a*°¢\(X,t)) (5.35) 
i=l 


can be considered as a design wave or a critical wave episode. It is the wave scenario 
with the highest probability of occurrence that leads to the exceedance of the speci- 
fied response level gg. For linear systems the result reduces to the standard Slepian 
model, see e.g. Lindgren (1970), Tromans et al. (1991), Adegeest et al. (1998) and 
Dietz et al. (2004). The critical wave episode is a useful result as it can be used as 
input in more elaborate time domain simulations to correct for assumptions made 
in the hydrodynamic code, Eq. (5.32), applied in the FORM calculations. Such a 
model correction factor approach provides an effective tool of accounting for even 
very complicated non-linear effects (Ditlevsen and Arnbjerg-Nielsen 1994). 

It should be noted that other definitions of design waves based on a suitable non- 
uniform distribution of phase angles have been applied, especially for experimental 
applications in model basins. The selection of the phase angle distribution is, how- 
ever, not obvious, see e.g. Alford et al. (2005). 
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5.7.3.2, Mean Out-Crossing Rates and Exceedance Probabilities 


The time-invariant peak distribution follows from the mean out-crossing rates. 
Within a FORM approximation the mean out-crossing rate can be written as fol- 
lows, (Jensen and Capul 2006): 


1 92 un 
6 tBrorm *2 4G Tis «2 (5.36) 
22Brorm 2d (u C )@ 
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based on a general formula given by Koo et al. (2005). Thus, the mean out-crossing 
rate is expressed analytically in terms of the design point and the reliability index. 
For linear processes it reduces to the standard Rayleigh distribution. Often the gra- 
dient vector {07,6} = {u*, a7} /Brorm to the design point does not vary much 
with exceedance level ¢y. Hence, Eq. (5.36) reduces to 


V(g0) — voe 2BForm (5.37) 


where Vo can be viewed as an effective mean zero out-crossing rate. Finally, on 
the assumption of statistically independent peaks and, hence, a Poisson distributed 
process, the number of exceedance of the level @o in a given time T can be calculated 
from the mean out-crossing rate v(@9): 


P max > eo = 1—e V(bo)T (5.38) 


The present procedure can be considered as an alternative to the random con- 
strained simulation, see e.g. Dietz et al. (2004). The present method has, however, 
the advantage that the number of time domain simulations is much smaller due to 
the very efficient optimisation procedures within FORM, and that it does not require 
the curve fitting of lines of constant probabilities needed in the other procedure. Fur- 
thermore, the present procedure does not rely on a mean wave conditional on a linear 
response and can hence be applied also to bifurcation types of problems like para- 
metric roll. In such cases the optimisation procedure used in the FORM analysis 
must be chosen appropriately, i.e. of the non-gradient type. In the present case a 
circle step approach is used, Det Norske Veritas (2003). Furthermore, to facilitate 
the convergence of the optimisation procedure, the limit state surface, Eq. (5.33), is 
replaced by a logarithm transformation: 


Buy, i, U2, i2,...,Un, in) = 
logt( do) — logt(¢(to |u1,i1, U2, 2, ode ,Un;Un)) =0 
1—log(—y);y <-1 (5.39) 


Finally, an arbitrary starting point different from zero is used. 
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The FORM is significantly faster than direct Monte Carlo simulations, while 
mostly very accurate. In a study Jensen and Pedersen (2006) dealing exclusively 
with parametric rolling of ships in head sea the FORM approach was found to be 
two orders of magnitude faster than direct simulation for realistic exceedance levels 
and with results deviating less than 0.1 in the reliability index. The difference in 
effort between Monte Carlo and FORM simulations might be even much larger, 
as shown in a recent seakeeping assessment study of Spanos et al. (2008). Similar 
observations are noted also in the present study. 

It should be mentioned that the present procedure bears some resemblance to the 
approach adopted by S¢borg and Friis-Hansen (2004). The difference is basically in 
the excitation process, where the present continuous wave excitation in S#borg and 
Friis-Hansen (2004) is replaced by a discrete excitation in time. The advantage of 
the present procedure is that it can directly represent the shape of actual wave spectra 
and that it provides an analytical formula, Eq. (5.36), for the mean out-crossing rate. 


5.7.4 Numerical Example 


A container ship with main particulars given in Table 5.9 is considered. The damping 
coefficients, 8;—B3, are taken, quite arbitrarily, from a different study vessel, Bulian 
(2005), but reasonably correspond to about 0.05 in equivalent linear damping. 

The coefficients in Eqs. (5.26) and (5.27) are given in Table 5.10. 

The units of the coefficients are metres with the roll angle given in radians. The 
approximations are accurate for roll angles up to 0.9 radians, Jensen and Pedersen 
(2006). It is noted that L, is slightly shorter than the length of the ship. The GZ 
curves are shown in Fig. 5.32 and it is clear that a significant reduction in righting 
lever occurs when the wave crest moves from AP to 0.25L forward of AP. This is 
quite typical for ships with fine hull forms like container ships. 

By use of the closed-form expressions given in Jensen et al. (2004) for the heave 
w and the wave-induced roll moment M5, all pertinent data for calculation of the 


Table 5.9 Main particulars of a container ship 


Length L Breadth B DraughtD Block , B, B; GMsy Radius of Speed V 
coeff. Cy SyYT. Tx 


284m = 32.2m 10.5m 0.61 0.012 0.40 0.42 0.89m 0.4B 6m/s 


Table 5.10 Coefficients in the analytical approximations for the GZ curves 


Ay A3 As Co, Do Ci, Dy C3, D3 Cs, Ds L. 


10.7964 2.30187 —2.97748 2.96515, 2.06522, —3.6616, 0.83496, 259.2 m 
—0.40240 0.83103 1.66807 —1.40701 


284 J. Jensen et al. 


0.3 0.6 0.9 % 0.3 0.6 0.9 
roll angle [rad] roll angle [rad] 


0 i 


Oo 


Fig. 5.32 Top: GZ curve in still water. Bottom: GZ curves in regular waves with wave length 
equal to the ship length L and a wave height equal to 0.05L. Wave crest positions at x. = 
0, 0.25L, 0.5L, 0.75L and L 


roll angle as function of time are defined. In order to show that Eq. (5.24) can model 
parametric roll, calculations have been performed with a regular wave with an en- 
counter frequency close to twice the roll frequency, Jensen and Pedersen (2006). 
Two wave heights are used: one (3.65 m) where parametric roll is not triggered and 
one slightly higher (3.7m) where parametric roll develops. The roll motions for 
the two wave heights are shown in Fig. 5.33. The onset of parametric roll and its 
saturation level are clearly noticed. 

The regular wave height needed to trigger parametric roll is thus about 3.7 m for 
the present vessel. If the wave height is increased above this value, parametric roll 
develops faster and to a higher saturation level. These results are consistent with 
both model test results and numerical calculations using more elaborate hydrody- 
namic codes, France et al. (2003). 

In the following, results are shown for parametric roll motions in head sea. Re- 
sults for other heading can be found in Jensen (2007). 

The reference sea state has a significant wave height H, = 12m and zero-crossing 
wave period T, = 11.7s. The zero-crossing period is chosen such that parametric roll 
can be expected due to occurrence of encounter frequencies in the range of twice 


600 


time t [sec] 


Fig. 5.33 Parametric roll in a regular wave (solid line) and the roll response for a slightly smaller 
regular wave (dashed line), Jensen and Pedersen (2006) 
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the roll frequency. Note, however, that neither the encounter frequency nor the roll 
frequency is constant in irregular waves. 

The time simulations are carried out from t = 0 to t = tg = 300s. The effect of 
the initial condition (@(t = 0) = 0.01 radians) is negligible after about 50s, but in 
order to build up parametric roll a longer duration is needed. With n = 50 equidistant 
frequencies, the wave repetition period relative to the ship is about 400 s depending 
on the forward speed. 


5.7.4.1 Parametric Roll in Head Sea in a Stochastic Seaway 


A detailed analysis using the present approach is given in Jensen and Pedersen 
(2006). As an example the most probable roll response and the associated critical 
wave episode, Eq. (5.35), corresponding to exceedance of a roll angle of 0.5 radians, 
are given in Fig. 5.34. 

The interesting observation is as stated in Jensen and Pedersen (2006): “The crit- 
ical wave episode is basically a sum of two contributions: firstly, a “regular” wave 
with encounter frequency close to twice the roll frequency and a wave height just 
triggering parametric roll and, secondly, a “transient” wave with magnitude depend- 
ing on the prescribed roll response ¢9”. The last part resembles the critical wave 
episodes as obtained from quasi-static response analyses (e.g. Adegeest et al. 1998) 
and has basically the shape of the autocorrelation function. The first term, which 
is independent of the prescribed response level, is unique for parametric roll, but is 
needed to initiate parametric roll. After the peak in roll angle has been reached (1.e. 
for t > 300s) the first part is seen to disappear. This is consistent with an uncondi- 
tional mean wave equal to zero. 

A parameter study has been made to quantify the sensitivity of the reliability 
index Brorm to the sea state parameters H;, T, and the forward speed V. As the 
wave spectrum does not change shape with H, the critical wave episode, Eq. (5.35), 
becomes independent of H,;. A change of H; by a factor u will then just change the 
design point and hence also Brory by a factor 1/u. This behaviour has previously 
been noted by Tongué and Sdding (1986) and is also mentioned and discussed in the 
IMO-SLF submission by Germany (2007). Clearly this property greatly facilitates 
the long-term convolution of the heeling angle. 
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Fig. 5.34 Top: Most probable roll response yielding ¢9 = 0.5 radians at tg = 300s. Bottom: Corre- 
sponding critical wave episode 
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Fig. 5.35 Reliability index Brorm as function of limiting roll angle ¢ for different zero-crossing 
periods T, and ship speeds V. Reference case: Head sea, H, = 12m, T, = 11.78, V=6m/s, n=50 
and to = 300s 


The variation with the zero-crossing period 7; is more complex, as shown in 
Fig. 5.35. Increasing 7; moves the two-to-one resonance condition away from the 
dominant encounter wave and roll resonance periods and hence increases Brory. By 
lowering T; an increase in Brow is seen for smaller roll angles whereas a decrease is 
noted for higher roll angles. This is due to the GZ dependence of the roll frequency, 
which implies that the roll resonance period decreases with increasing roll angle. 

The variation with ship speed V, Fig. 5.35, shows that the probability of paramet- 
ric roll decreases, if the speed is either lowered or increased for the present example. 
For lower limiting roll angles it is seen to be better to increase the speed than to re- 
duce it, assuming that sufficient powering for the ship is available. 

Finally, it is noted that for a linear system the reliability index Brory would be 
linearly dependent on the limiting roll angle @o (with the standard deviation as scale 
parameter), but this is clearly not the case here. 
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5.8 Mustering, Evacuation and Rescue 


The process of evacuating a passenger ship is a very complex one, not least because 
it involves the management of a large number of people on a complex moving plat- 
form, of which they normally have very little knowledge. These characteristics make 
ship evacuation quite different to evacuation from airplanes and buildings as the first 
only involve relatively simple geometries, whilst the second imply steady platforms, 
normally with no need for assistance to be given to its occupants during an evac- 
uation and no need for their preparation to survive a harsh environment following 
a successful evacuation. These inherent problems, coupled to limitations in time to 
the extent that evacuation may often be untenable, render decision making during a 
crisis a key to successful evacuation and any passive or active support encompass- 
ing design for ease of evacuation, crew training, evacuation plans/procedures and 
intelligent systems onboard critically important. 

Following the Herald of Free Enterprise and the Estonia ferry disasters, work 
at the IMO Marine Safety Committee (MSC) focused on the development of rec- 
ommendations and guidelines to ensure safe and efficient evacuation procedures for 
passenger ships. This has led to the definition of guidelines for the numerical simula- 
tion and analysis of the evacuation processes of passenger ships, as laid down in the 
interim guidelines MSC/Circ.909 (IMO 1999), later superseded by MSC/Circ.1033 
(IMO 2002) and lastly updated MSC/Circ.1238 (IMO 2007). It is noted, however, 
that the recommended analysis is only mandatory for newly built Ro-Ro passenger 
ships in compliance with SOLAS reg. I-/28-1.3 and reg. II-2/13.7.4 (which entered 
into force on July 1, 2002), whereas for other existing or newly built passenger ves- 
sels (cruise ships) the IMO recommends the analysis acc. to the guidelines on a 
voluntary basis. More stringent recommendations are likely to follow in the future, 
when a variety of issues related to large passenger ship safety have been settled 
at IMO. 


5.8.1 The Shipboard Evacuation Problem 


Before proceeding with the intricacies of the evacuation analysis and the description 
of related simulation tools, it is important to define the problem we try to solve and 
the degree to which this problem is defined adequately for any evacuation analysis 
to be meaningful. 

In general, the ability to evacuate a ship environment within a given time and 
for given initial conditions (Evacuability) may be defined as follows Vassalos et al. 
(2001a,b, 2002, 2003 and 2004) (Fig. 5.36): 


E=f{env,d,r(t), s[evacplan, crew functionality, mobility impairment index]; t} 
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Fig. 5.36 The concept of Evacuability (E) 


Based on this expression, the following needs to be explained and emphasised: 


e Initial Conditions (IC): env, d, r(t) 

env: Ship environment model, pertaining to geometry, topology and domain 
semantics. For any comparisons to be meaningful we need to assume a time in- 
variant environment for evacuation simulations. An environment changing with 
time (e.g., blocking doors and exits online) could not easily allow for quantifi- 
able assessment of these effects, as it would be very difficult to repeat any such 
action in precisely the same state of the simulation model. However, the ability 
to change the environment online could offer a strong basis for crew training and 
for decision support in crisis management. 

d: Initial conditions of the evacuation problem, pertaining to spatial and tempo- 
ral demographics of the people onboard. The actual demographics will actually 
be randomly distributed with the possibility of fixing some initial values, e.g., 
placing handicapped people on the embarkation decks and/or near an exit. As 
such, the initial distribution of people’s demographics ought to be sampled to 
identify its effect on evacuability. The latter could be avoided if the distribution 
is known with sufficient accuracy (confidence) that a specific spatial distribution 
in a given time is taken to define a specific scenario for evacuation notation (or 
indeed any other operational or design) purposes. 

r(t): Response time, assumed to follow a uniform random distribution and 
hence it has to be sampled for various distributions in order to evaluate its effect 
on evacuability. 

IC should be defined and remain fixed during the execution of the simulation. 
Guidance notes/rules could be devised as part of the evacuation notation to en- 
sure that such conditions are defined correctly and uniformly. Once the initial 
conditions are defined, simulation could then begin. 

e Evacuation Dynamics (ED): s [evacplan, crew functionality, mobility impairment 
index] 

s(ni): Walking speed of individual flow units, constituting the main motion 
variable of evacuation dynamics. The fact that each person onboard is dealt with 
as an individual flow unit and that every procedural (evacplan)/functional(crew 
assistance)/behavioural(microscopic) parameter could be accounted for as a mul- 
tiplicative factor in ascertaining walking speed, provides for a unique and 
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relatively easy way in simulating evacuation, essentially being able to deal with 
the effect of all of these parameters by simply following a given evacuation plan, 
accounting for crew assistance in some agreed quantifiable way and then sample 
walking speed for each individual flow unit from a corresponding distribution 
(see Figs. 5.1-5.10). Using the relevant Mobility Impairment Index (MII) the 
walking speed in each case can straightforwardly be calculated. From a develop- 
ment of realistic simulation of evacuation point of view, a great deal of effort may 
have to be expended to accurately quantify MII for all the pertinent microscopic 
behaviour as well as for specific crew assistance. 

It should be noted that though there are common elements in the simulation 
of passenger evacuation equally applicable to ships, buildings or aircrafts, there 
exist critical differences between them which are likely to have a significant (and 
hence crucially important) effect on the outcome that ought to be addressed at 
the outset. These include the following: 


5.8.1.1 Modeling the Ship (Virtual) Environment 


Geometry: The complexity of ship geometry needs to be properly modeled and to 
account for a great variety of possible escape routes. The difference between an 
innovative VR model and brute-force modeling could be an order of magnitude in 
the time taken to produce a virtual ship model and a similar margin is expected 
concerning the size of data set. 

Topology: Closely related to ship geometry and hence unique to ships are topo- 
logical issues and schemas of evacuation “flows”, for example multiple configura- 
tion layouts that could lead to disorientation and confusion of passengers. 

Semantics: Most semantic specific information is crucially affecting evacuation, 
mainly because of the geometric complexity but also due to adversity of the sea- 
ship environment, reinforced by uncertainties in the time available, distance to land, 
functionality of Life Saving Apparatus, etc. 

Platform: Ships move, on occasions severely, which further exacerbates disori- 
entation and reduces mobility, whilst other contributing factors more often than not 
worsen this situation further, e.g., progressive flooding that may also curtail evacu- 
ation time to the extent that evacuating thousands of people in situations that may 
include restricted access became untenable. 

Sea environment: Evacuation pertaining to dry land-based scenarios, means es- 
caping to safety. In ships, it usually means escaping to sea, where rescue is far from 
being settled. 


5.8.1.2 Modeling Human Behaviour 
Passenger numbers: In the majority of other cases, evacuation from enclosed spaces 


does not involve very large numbers of people. This is, however, not so with pas- 
senger ships and especially ultra large cruise ships. This in itself presents modeling 
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problems in terms of macroscopic and microscopic movement of people, process- 
ing capacity and information handling. These, in turn, give rise to needs of multi- 
threaded programming and parallel processing, particularly for use in immersive 
technology and/or employing the navigation interface of a virtual reality integrated 
environment. 

Way-finding and path selection problems: Deriving from the ships’ geometric 
complexity, these problems are exacerbated by the moving base, often severe time 
constraints and the anticipation of an awaiting unfriendly environment, thus com- 
plicating most aspects of human behaviour. 

Uncertainty modeling: This derives from the unpredictability of human be- 
haviour as well as the inherent structural instabilities associated with the passenger 
ship evacuation problem. 


5.8.1.3 Passenger Mustering/Evacuation Process Modeling 


Procedures: Evacuation strategies, procedures and decision support systems are 
likely to affect drastically the success of passenger evacuation in ships, more so 
than in other enclosed spaces, again primarily because of the plethora of parameters 
likely to affect evacuation in such a complex environment with so many people. 

Evacuation scenarios: In addition to evacuation strategies that may be considered 
(abandon ship, transfer to refuge centres or a combination of the two) and the range 
of possible incidents (fire, collision, progressive flooding, cargo shift, foundering), 
it is in the multitude of scenarios that innovative thinking is imperative. 

Holistic approach: It would be sub-optimal to model the various procedures (as- 
sembly, embarkation, launching of life boats, etc) separately or indeed sequentially. 
A holistic approach is necessary to understand the evacuation process in ships and 
to properly model and analyse it for design, operational and regulatory purposes. 

Ship abandonment: When transfer to refuge centres is not an option, ship aban- 
donment is most important aspect of passenger evacuation and wholly ship specific 
(albeit there is strong similarity with offshore platforms) involving such aspects as 
ship and LSA dynamics and LSA functionality issues whilst accounting for human 
behaviour. 


5.8.1.4 Multi-Agent Modeling 


The lowest common denominator of the many definitions of “agent” is an encap- 
sulation of code and data, which has its own thread of control and is capable of 
executing independently the appropriate piece of code depending on its own state 
(the encapsulated data), the observables (the environment) and the stimuli (mes- 
sages from other parts of the system or interactively provided). The agent’s action 
model is essentially a “sense-decide-act” loop. The sense and decide steps may be 
coalesced, as the sensing is nothing more than the interface of the agent with the data 
structures representing the environment. The decision process requires access to the 
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perceived information, thus perception is not a complex process but rather a simple 
access interface between the environment and the agents. Notably, the actions of 
agents may also change the environment, giving rise to what is called interactive 
fiction. 

Multi-agent is a further generalisation of process-based modeling methods where 
the environment is very well defined and the agents may communicate in a fairly 
versatile manner. In natural systems, all component parts “live” in some sort of 
topological space (predators and prey may live on a two dimensional forest floor, 
data packages traverse a network graph and the evacuees move around on a 2D 
deck or offshore installation layout). An environment is defined to be an artificial 
representation of this space. Autonomous agents can perform the activities defined 
by a computer program in this environment. This strong sense of environment does 
not exist in a process-based simulation. Processes are only aware of themselves and 
the resources they wish to acquire. 

In the implementation the environment is an appropriate collection of data struc- 
tures in the computer. Communication in multi-agent simulation describes all inter- 
action between real-life entities. This makes multi-agent simulation an extremely 
powerful tool but also one, which is hard to verify in the context of known mathe- 
matical theory. The essence of using agents requires a rigorous definition and full 
implementation of the environment and its interfaces with the agents as well as an 
inter-agent communication protocol, as described next. 

Modeling the environment model is one of the most important aspects of multi- 
agent modeling. In the whole, this consists of three aspects - geometry, topology and 
domain semantics. The perception model for the agents will be able to use the infor- 
mation in these three abstractions at different levels of the decision processes. The 
whole ship layout is segmented into Euclidian convex regions (simple rectangles in 
Evi 3.0) with a structure of a linear space, directly connected if they have a common 
gate. This connectivity topology, for all computation and analysis purposes can be 
represented by a graph. 

In ship layout terms regions are defined as cabins, corridors, public areas (or 
subsets of these), each with its own connectivity, defined by the gates (these may be 
actual or artificial doors). Figures 5.37, 5.38 and 5.39 next illustrate schematically 
these ideas. The path of the agents leading to the embarkation station is determined 
by searching the connectivity graph of the doors. Currently, the length of the path is 
taken as the criterion of optimality for network flow. 

A minimal description of the ship layout will enable designers to modify the 
layout easily (add a new corridor or a staircase in virtually no time without having 
to draft the details of it using an elaborate CAD tool), hence obtaining evacuation 
performance faster, and thereby making simulation an ideal design tool. 

The contrary can be also easily achieved - by simply blocking areas, regions or 
whole fire zones one can easily examine the effect of these changes and therefore 
the sensitivity of each different part of the vessel on evacuation capability. 

Furthermore, the availability of a7 2D and 3D models allows for real time vi- 
sualisation, in which the complete geometric details of the ship and human agents 
may be utilised to provide an extremely realistic representation. As an alternative, 
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Embarkation Station 


Fig. 5.37 Simple illustration of the path-planning algorithm 


Upper Decks Evacuating 


Fig. 5.38 Simulation of evacuation by the EVI v.3.1 software (http://www.safety-at-sea.co.uk/evi) 


the code can also be executed separately, allowing a much faster evaluation of a 
simulation and leaving visualization as a post-processing alternative. 


5.8.1.5 Mesoscopic Modeling 


The evacuation objective moving a large number of passengers from one area of 
the ship to another requires two levels of modeling. At the high level, there is the 
planning and development of routing information which will guide an agent through 
the environment topology. At the low level, the agent is required to travel between 
the entrance and exits of the geometry, and to avoid the walls, obstacles and other 
agents moving the surrounding environment. This combination of macroscopic and 
microscopic detail is termed Mesoscopic modeling. 
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Fig. 5.39 Snapshot of simulation of the evacuation of a Ro-Ro ferry by vVEXODUS v 1.11 (www- 
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5.8.1.6 Macroscopic Modeling — High Level: Path Planning and Graph Search 


With increasing complexity of the minimal geometry of the ship to thousands of 
doors and regions, it is very important to have an efficient path-planning process. 
The path-planning algorithm adopted is illustrated in Fig. 5.37, explaining how only 
the distance information from each door to the embarkation station needs to be left 
with the door’s id. When an agent is located in a region, the distance information 
from each door of the region can be obtained, thus allowing the agent to simply head 
to the shortest path leading to the destination area. Re-planning during evacuation 
is also possible if, for example, there is a dense crowd “blocking” the path or a 
blackout in the presence of fire or smoke. 


5.8.1.7 Microscopic Modeling — Steering of Agents 


Given that environment is modeled as small discrete convex geometric elements, 
the process of moving from one door (gate) to another becomes a process of the 
pursuit of a static target. However, with additional complexities such as other agents 
and obstacles, the process of steering becomes significantly more complex. The de- 
cision of how to approach this specific problem is one which determines the entire 
design of the simulation architecture. The key issue is the identification of a tech- 
nique which will allow enough information to be retrieved from the surrounding 
locality to enable a decision to be made on a course of action. Consequently, the 
choice of solution depends on matching the efficiency of the technique for obtain- 
ing information from the locality to the desired range of decisions (capability) of 
the agent. There are several solutions to this problem. 

Grid based techniques: Grid based techniques simplify the problem of obtain- 
ing information from the surrounding locality by dividing the space up into a grid. 
Consequently, it is then very easy for an agent to search neighbouring squares. This 
approach makes for a very rapid simulation tool. However, due to relationship be- 
tween the size of the square and the size of agents there is only a relatively low 
number of decisions that can be taken. Furthermore, discrete grid bases approaches 
are severely limited on variety of geometries that can be represented. 

Social Force Methods: Social force methods can be see as the exact opposite 
to the grid based approach. These methods aim to model the interaction between 
agents and obstacles in great detail. A force based system is used, controlled by the 
distances between, to obtain a technique can provide continuous decisions. In accor- 
dance with the force based approach, agents operate in a continuous space which al- 
lows for a maximum range of flexibility in the geometric environment. However, the 
continuous space approach is very expensive when it comes to determining informa- 
tion around the locality of an agent. Consequently, this approach is not particularly 
effective for tools operating in a practical engineering environment. 

Hybrid approaches: Evi uses a hybrid approach which aims to take the advan- 
tages from the other two techniques. It represents an approach which aims to utilise 
the effectiveness of grid based technique with the flexibility of social force methods. 
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In order to simplify calculation, a range of discrete decisions are established around 
the agent with the objective of identifying the one which will allow the agent to 
travel the greatest distance toward the local target. In addition, a continuous local 
(social/personal) space is established around each agent which other agent will aim 
to avoid. This space is use to prevent deadlock situation when the number of agents 
in an area become dense. The agent makes a decision of the best use of its personal 
space to resolve any conflicts that may arise. As a result, this approach allows the 
evacuation process to be modelled in sufficient detail and still run in real time. 


5.8.2 Tools for Simulation and Analysis of Passenger Mustering 
and Evacuation of Ships 


There are a variety of ways to scientifically and practically address this topic. 
Regression models, queuing models, route-choice models, gas-kinetic and macro- 
scopic models, microscopic models, have all been used as different approaches to 
the problem of the evacuation analysis Schreckenberg and Sharma (2002). Never- 
theless the most impressive and promising approach is that of application of simpli- 
fied or more advanced Virtual Reality Simulators (Kostas, 2006). Such tools have 
been introduced in the past solely as navigation or maneuvering simulators requir- 
ing sophisticated hardware and significant investments. The most known software 
systems that are nowadays applied to the assessment of the shipboard evacuation 
are briefly described and comparatively assessed in the following. 


5.8.2.1 EVI (http://www.safety-at-sea.co.uk/evi) 


EVI (Evacuability 7ndex) is a multi-agent evacuation simulation software pack- 
age developed in compliance with the requirements of IMO’s interim guidelines 
MSC/Circ.1033 (IMO 2002). For a detailed coverage of the employed methods and 
the underlying research work embedded in EVI, the reader can consult the EVI re- 
lated publications: Dogliani et al. (2004) and Vassalos et al. (2001a,b, 2002, 2003 
and 2004). 

EVI was originally developed at the Ship Stability Research Centre (SSRC) of 
the Universities of Glasgow and Strathclyde; the software was further refined and 
is now marketed by Safety at Sea. It is one of the few evacuation simulation tools 
developed specifically to address shipboard evacuation in the marine environment. 
It is also one of the few tools to use continuous space modelling allowing any ship 
accommodation layout to be accepted. The simulation can be visualized in a 3D vir- 
tual reality-like environment allowing the progress of the evacuation to be reviewed. 
Any congestion or locations of bottlenecks can be thus rather easily identified. Fur- 
thermore, the tool features full telemetry and playback so that the user can review 
and replay at any time during the simulation. The latest release, EVI 3.1, addresses, 
as stated by its developers, ship evacuation issues beyond the IMO guidelines by 
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introducing features which can give through-life support in the design, operational 
and training requirements of a passenger vessel. 

A central issue of the research work supporting the EVI package is the meso- 
scopic modeling. As stated by its developers: 


The evacuation objective of moving a large number of passengers from one area of the 
ship to another requires two levels of modelling. At the high level, there is the planning 
and development of routing information which will guide an agent through the environment 
topology. At the low level, the agent is required to travel between the entrance and exits of 
the geometry, and to avoid the walls, obstacles and other agents moving the surrounding en- 
vironment. This combination of macroscopic and microscopic detail is termed mesoscopic 
modelling. 


The crowd modelling methodology of EVI follows a rather top-down approach. 
Specifically, EVI combines grid based techniques and social force methods to arrive 
to a real-time (grid-based techniques are generally very fast but rather simplistic) 
and at the same time natural looking simulation outcomes. 


5.8.2.2 EXODUS (http://fseg.gre.ac.uk/exodus/) 


EXODUS is a software platform developed at the Fire Safety Engineering Group of 
the School of Computing & Mathematical Sciences of the University of Greenwich. 
For a detailed coverage of the theoretical background and the main features of EX- 
ODUS, see its main related publications: Caldeira-Saraiva et al. (2004) and Galea 
et al. (2004). EXODUS consists of several software products targeting a variety of 
evacuation environments. These products are: 


airEXODUS: for applications involving aircrafts. 

buildingEXODUS: for all type of buildings (hospitals, sport facilities, airport 
terminals etc). 

maritimeEXODUS: for ship evacuation. 

railEXODUS: for train simulations. 


Furthermore vVEXODUS, when coupled with one of the above products, enables 
the generation of animation sequences of computed simulations. 
Specifically, maritimeEXODUS has the following features and capabilities: 


1. Recognition by passengers of the need for emergency action i.e. response 
to alarm. 

2. Preparatory actions e.g. collect life jacket, reunite family, deploy crew, etc. 

3. Progressive evacuation to place of relative safety i.e. refuge or assembly station. 

4. Preparation/deployment of escape system e.g. prepare lifeboats, deploy Marine 
Evacuation System (MES). 

5. Abandoning the vessel e.g. boarding and lowering lifeboats etc. 


Depending on the nature of the “what if” conditions being simulated, all of the 
above features may be included, while other, more focused scenarios, may only 
require some of these components. For performing the required simulation scenarios 
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reliably, the evacuation model is equipped with the appropriate set of functionalities 
and access to the necessary data sets. Furthermore, the scenario under consideration 
may target situations occurring in calm sea conditions or involve situations with 
list or roll and may be evaluated at day or night. Naturally, this diversity imposes a 
requirement for a variety on the data sets and the modelling capabilities. 

maritineEXODUS makes use of marine specific data for the simulation of the 
performance of passengers under conditions of ship’s list and heel. These data sets 
have been collected by partners of the developer’s group at FSEG. As the model 
has the flexibility to allow the user to alter all of the pre-set default values, it is 
easily adaptable when new data becomes available. Furthermore, the abandonment 
component of maritimeEXODUS permits, as its name implies, the simulation of 
the abandonment phase. This includes the use of most currently available escape 
systems such as MES, davit launched lifeboats, life rafts, etc. In maritimeEXODUS 
V4.0, new capabilities for handling vertical ladders, 60 degree stairs, water tight 
doors and hatches have been included. 


5.8.2.3 AENEAS 


(http://www.gl-group.com/maritime/newbuilding/shipsafety/aeneas/) 

AENEAS is a similar software package used for passenger evacuation analysis; it 
has been developed in close cooperation between Germanischer Lloyd and TraffGo. 
It is, as EVI, in full compliance with the specifications of IMO MSC/Circ.1033 and 
the latest MSC/Circ.1238 (IMO 2007). The underlying modelling and the method- 
ological approach are presented in Meyer-KO6nig et al. (2007) and Valanto (2006). 
AENEAS follows a rather bottom-up per-person agent modeling approach. AI- 
though its agent modeling and behavioral scheme is rather simplistic, it has been 
shown to deliver realistic results. 

In brief AENEAS uses the ship’s general arrangement plan and automatically 
divides it into a grid of square cells that are used both for agents and space rep- 
resentation. Software agents model the individual persons with properties ranging 
from simple walking speed up to “equations of motion” of considerable complex- 
ity. AENEAS is a fast-performing simulation tool that allows frequent simulation 
repetitions even for large crowd populations (3000-4000 persons). 


References of Section 8 


Caldeira-Saraiva F, Gyngell J, Wheeler R, Galea E, Carran A, Johansson K, Rutherford B, Simoes 
A (2004) Simulation of Ship Evacuation and Passenger Circulation. Proceedings of the 2nd 
International Maritime Conference on Design for Safety, Sakai, Japan, pp. 197-205. 

Dogliani M, Strang T, Vassalos D (2004) Evacuation Notation — A New Concept to Boost Passen- 
ger Evacuation Performance in the Cruise Industry. Proceedings of Compit 04, Sigtienza, Spain. 


300 J. Jensen et al. 


Galea E R, Lawrence P, Gwynne S, Sharp G, Hurst N, Wang Z, Ewer J (2004) Integrated Fre and 
Evacuation in Maritime Environments. Proceedings of the 2nd International Maritime Confer- 
ence on Design for Safety, Sakai, Japan, pp. 161-170. 

IMO (1999) Interim Guidelines for a Simplified Evacuation Analysis on Ro-Ro Passenger ships. 
MSC/Circ.909, 4 June. 

IMO (2002) Interim Guidelines for Evacuation Analyses for New and Existing Passenger Ships, 
MSC/Circ.1033, 6 June. 

IMO (2007) Guidelines for Evacuation Analyses for New and Existing Passenger Ships. 
MSC/Circ.1238, 30 October. 

Kostas K V (2006) Virtual Reality Kernel with Support for Ship Life-Cycle Modeling. PhD Thesis, 
School of Naval Architecture & Marine Engineering, National Technical University of Athens, 
Athens. 

Meyer-K6nig T, Valanto P, Povel D (2007) Implementing Ship Motion in AENEAS — Model Devel- 
opment and First Results. Pedestrian and Evacuation Dynamics 2005, Springer Verlag, Berlin- 
Heidelberg. 

Schreckenberg M, Sharma S D (ed) (2002) Pedestrian and Evacuation Dynamics. Springer-Verlag, 
Berlin-Heidelberg-New York. 

Smith C S (1977) Influence of local compressive failure on ultimate longitudinal strength of a 
ship’s hull, Proc. PRADS77, International Symposium on Practical Design in Shipbuilding, 
Tokyo, Japan, pp. 72-79. 

Valanto P (2006) Time-Dependent Survival Probability of a Damaged Passenger Ship — Evacuation 
in Seaway and Capsizing. Technical Report 1661, HSVA. 

Vassalos D, Christiansen G, Kim H S, Bole M, Majumder J (2002) Evacuability of Passenger Ships 
at Sea. SASMEX. 

Vassalos D, Guarin L, Bole M, Majumder J, Vassalos G C, Kim H S (2004) Effectiveness of 
Passenger Evacuation Performance For Design, Operation & Training Using First-Principles 
Simulation Tools. Escape, Evacuation & Recovery, Lloyds Lists Events, London. 

Vassalos D, Guarin L, Vassalos G C, Bole M, Kim H S, Majumder J (2003) Advanced Evacuation 
Analysis — Testing the Ground on Ships. Pedestrian and Evacuation Dynamics, Greenwich. 
Vassalos D, Kim H S, Christiansen G (2001a) Passenger Evacuation in a Virtual Ship-Sea Envi- 

ronment and Performance-Based Evaluation. Cruise and Ferry, May 2001. 

Vassalos D, Kim H S, Christiansen G, Majumder J (2001b) A Mesoscopic Model for Passenger 
Evacuation in a Virtual Ship-Sea Environment and Performance-Based Evaluation. Pedestrian 
and Evacuation Dynamics, Duisburg. 


5 Methods and Tools 301 


5.9 Concluding Remarks 


This chapter has presented a number of recently developed numerical methods and 
software tools to predict the probability of occurrence and the consequences of vari- 
ous accidental scenarios for ships. Some of the methods and tools seem quite mature 
and have been validated with experiments, whereas others still are subjected to sig- 
nificant research and development efforts. 

The tools should give the ship designer valuable help when optimizing and as- 
sessing the layout and safety of innovative ships. In addition the tools are important 
for rule-making bodies and maritime safety authorities as they are needed in the pro- 
cess of changing from prescriptive to rational, performance-based rules and design 
procedures. 


Chapter 6 
Applications 
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In this chapter, three applications of risk-based approaches to ship design are elab- 
orated, namely the development and design of a lightweight composite sandwich 
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AFRAMAX tanker for enhanced capacity and reduced environmental impact and 
the development and design of a fast displacement RoPax vessel of enhanced sur- 
vivability and performance. 
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6.1 Lightweight Composite Sandwich RoPax Superstructure 


Dag McGeorge, Bjgrn Hgyning and Henrik Nordhammar 


Abstract Lightweight composite materials have a long and successful track record 
in demanding and weight-critical applications. The benefits of lightweight compos- 
ite materials have so far not been available to the merchant ship designer because 
international regulations require that the structure shall be made of non-combustible 
materials. However, these regulations allow alternative arrangements that deviate 
from such prescriptive requirements provided that adequate safety is demonstrated 
by an engineering analysis. For a RoPax ship this method has shown that a weight 
saving of about 60% can be achieved for the superstructure if the traditional steel su- 
perstructure is replaced by a lightweight composite design. This estimate accounts 
for structural fire protection and other risk control measures. An acceptable level of 
safety was documented for the new risk-based composite design. This demonstrates 
the feasibility of significant weight saving in superstructures of merchant ships by 
using composite materials and gives promise for more efficient and profitable mer- 
chant ship designs in the future. 


6.1.1 Introduction 


Fibre reinforced plastic (FRP) composite materials offer high strength at low weight. 
A particularly effective form of construction is obtained by using sandwich pan- 
els where two light and strong FRP laminates are separated by a lightweight core 
as illustrated in Fig. 6.1. Such sandwich structures provide both high stiffness and 
strength at low weight compared to other common forms of construction. For this 
reason, FRP sandwich structures have been used extensively in such demanding 
maritime applications as high speed craft and naval ships. 

Although weight is more critical in high speed craft than in other merchant ships 
and composites offer additional advantages in some types of naval ships, weight 
saving is attractive also for merchant ships. The application of composite materials 
to merchant ships has, however, been very limited because the International Con- 
vention for the Safety of Life at Sea (SOLAS) (IMO 1974) requires that “the hull, 
superstructures, structural bulkheads, decks and deckhouses shall be constructed of 
steel or other equivalent material” (Ch II-2 Reg. 11), the latter being defined as 
non-combustible materials (Ch I-2 Reg. 3.33). This has till now prevented the use 
of combustible composite materials in the main load-bearing structure of ships ap- 


proved according to SOLAS. 
TEST 


Fig. 6.1 The sandwich form Strong and stiff lightweight 
of construction composite face sheets 
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SOLAS was recently amended with the new Regulation 17 in Ch II-2 allow- 
ing for approval of alternative designs and arrangements provided that the safety of 
the alternative arrangement is documented by an engineering analysis. A composite 
design may be regarded such an alternative arrangement and, provided that ade- 
quate fire safety can be documented, the SOLAS convention provides an opening 
for approval of such designs. In what follows, the benefits of using this opening to 
introduce light-weight composite structures to shipbuilding are demonstrated. 


6.1.2 Developing the Novel Risk-Based Design 


The initial design case selected for this work was an existing RoPax passenger vessel 
with roughly a length of 200m, a deadweight capacity of about 7,500 tonnes, a 
tonnage of about 33,000 GT, 3,100 lane meters and 500 passengers. A so-called 
base design for the superstructure module of this ship was developed according to 
the current state of the art composite sandwich technology. The major features of 
that base design are described in the next sub-section. Through a risk based design 
process described in the subsequent sub-sections the design was further improved 
by a number of cost effective risk control options (RCOs). The risk assessment 
supporting the design process is described briefly. The cost effective RCOs that 
distinguish the final risk based design from the base design are summarized. They 
proved the feasibility of the concept. In a next step, a new vessel design of Stena 
Rederi AB was considered and the risk assessment was adapted to cover also the new 
design. The superstructure modules considered in the study are shown in Fig.6.2. 
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Fig. 6.2 The composite superstructure modules considered in the SAFEDOR study 
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6.1.2.1 The Base Design 


The sandwich concept illustrated in Fig. 6.1 was used to obtain a light-weight design 
of the superstructure module. Composite face sheets of vinyl ester thermosetting 
polymeric material reinforced with glass fibers were used. The core material should 
be light but stiff in shear. Common core materials include balsa wood and polymeric 
foams usually made of rigid PVC. 

All interiors such as cabin modules, decorative surface panels etc were chosen to 
be of standard commercial types that fulfil the SOLAS requirements to such items 
and are in use onboard steel designs and are hence approved for use in ships. 

Both the face and core materials are combustible. If directly exposed to a fire, 
these materials would contribute to the fire and the fire could also spread on the 
exposed surfaces. That could compromise the ship’s fire safety. Therefore all the 
surfaces inside the super-structure were protected by a suitable fire protection sys- 
tem. Structural panels that are hidden behind standard elements, e.g. decks and bulk- 
heads in accommodation areas, would have standard low cost fire protection systems 
typically of mineral wool. Other structural panels such as bulkheads facing corridors 
are protected with dedicated fire protection systems that have a decorative and robust 
surface. Some systems of this type have been earlier described and characterized by 
Gutierrez et al. (2005) and McGeorge and Hgyning (2002). All the surfaces satisfy 
the fire reaction requirements specified in the IMO HSC Code (IMO 2000). These 
requirements are stricter than those of the SOLAS convention. 

This ensures that, as long as the fire protection capacity is not exceeded, the 
behaviour of the composite superstructure in a fire will be at least as favourable 
as that of a traditional steel design. The critical question for equivalence with pre- 
scriptive steel designs is the risk contributions associated with the rare events of 
fires that last longer than the fire protection time of the FRP structure such that 
the combustible structural material is exposed. This is addressed herein by the risk 
assessment. 

The weight of the lightweight module was only about 40% of that of the existing 
traditional steel design. This weight comparison includes all fire and thermal insu- 
lation and represents the real weight difference of the two arrangements as installed 
onboard. The cost of this weight saving was estimated to about 5 € per kg. Whether 
this is commercially attractive depends on the intended trade of the vessel, but plau- 
sible examples were identified where the cost increase would be expected to pay 
back in one to two years of service. 


6.1.2.2 The Risk Based Design Process 


A risk based design process was performed involving the usual steps of a risk as- 
sessment: hazard identification, ranking of risks using a qualitative risk assessment, 
identification of risk control options (RCOs), quantitative risk assessment with focus 
on the most critical risks and a decision process where the most effective risk con- 
trol options were adopted. To ensure that the most critical risks and the best RCOs 
were identified and that the most appropriate methods were used to assess risks; 
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26 experts were involved in the risk based assessment and design process. These 
26 experts covered all relevant areas of expertise and represented all stakeholders. 
Several design iterations were performed. In the first iteration, focus was placed on 
identifying design solutions that were effective in meeting the design objectives. 
Then focus was gradually shifted towards identifying effective ways of controlling 
the risks associated with the novel design. To support this process, each expert was 
involved at the most appropriate stage in the design process. 

The estimated risks were compared to the risk acceptance criteria given in 
Table 6.1. The criteria were derived from a set of recommended risk acceptance 
criteria suggested by Skjong et al. (2005) considering that the total risk will be 
dominated by the more severe risks due to collision and grounding such that the 
superstructure fire risk should only represent a small fraction of the total acceptable 
risk. Hence, the criteria used for superstructure fires are much stricter than the crite- 
ria suggested by Skjong et al. (2005) and correspond to the difference between those 
and the historic risks from collisions, grounding and engine room fires as reported 
by Vanem and Skjong (2004a, 2004b). The individual risk acceptance criteria cover 
individual risks to passengers and crew. If the individual risks exceed any of those 
criteria, the level of risk is unacceptable and must be reduced. Furthermore a societal 
risk criterion was specified in terms of the potential loss of lives (PLL). This number 
represents the statistical expectation of the number of fatalities per year of operation 
of an average ship. Exceeding the societal risk criterion implies that the risk level 
is too high and that the risk must be reduced irrespective of costs. Finally, a cost 
effectiveness criterion is specified in terms of the cost of averting a fatality (CAF). 
This criterion need not be used if one can show that the societal risks are negligible. 
However, the historic collision and grounding risks are themselves significant. They 
were not aimed to be reduced in the present work. Therefore, irrespective of the new 
design, the total risk could not be regarded negligible and the CAF criterion would 
have to be used. This criterion does not apply to the design itself, but to identified 
RCOs. It implies that, after all the other risk criteria are met, RCOs having a CAF 
less than the given CAF criterion should be implemented to further reduce risk such 
as to become As Low As Reasonably Practicable (ALARP). 


Table 6.1 Acceptance criteria for superstructure fires 


Limit for intolerable individual superstructure fire risk for passengers 8.2 10-> per ship year 
Limit for intolerable individual superstructure fire risk for crew 7.5 10-4 per ship year 
Limit for intolerable societal superstructure fire risk expressed as PLL —-0..0005 

Cost of averting a fatality (CAF) used for evaluation of RCOs 3 million USD 


(to be used as indicator including also serious and less serious injuries). 


6.1.2.3 Major Features of the Risk Based Design 


The risk assessment showed that, for the base design, the fire risk associated with the 
superstructure was much less than other risks (e.g. risks associated with grounding 
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and collision), but nevertheless that the risk was indeed significant, above the target 
level and higher than that associated with a traditional steel design. Furthermore, 
assessment of RCOs identified through the risk based design process showed that 
there were a number of cost effective RCOs. The results of the risk assessment are 
summarized below. The RCOs considered cost effective on the basis of the risk 
assessment were: 


e The use of a drencher system that is able to sprinkle water on the external surfaces 
of the superstructure. The aim of this RCO is to cool the external surfaces of the 
superstructure in the event of a fire so as to prevent the propagation of a fire via 
the external surfaces should external windows or doors fail to contain the fire. 

e The use of windows and doors in external bulkheads that are rated to survive for 
at least 60 min in the standard fire. The aim of this RCO is to prevent flames and 
smoke from a fire inside the superstructure to escape to the outside and poten- 
tially cause fire propagation and a threat to the passengers that have escaped from 
the fire zone. 

e The use of an emergency control station away from the bridge allowing control- 
ling the fire-fighting and escape operations as well as navigating towards a safe 
refuge even if the bridge has had to be abandoned. 


These RCOs had only a small impact on the weight and cost of the lightweight 
composite design and are unlikely to compromise the profitability of the novel design. 


6.1.3 Fire Risk Assessment 


A fire onset onboard a ship is not a particularly uncommon occurrence. However, 
due to effective fire safety measures, almost all fire onsets are safely extinguished 
before becoming a threat to passengers or crew. In rare cases, however, the fires 
develop and become a threat. Whether this happens or not depends on factors such as 
whether detection and active fire fighting systems function as intended, the precise 
location of the fire onset, the presence of persons nearby, their training and state 
of mind, whether fuel for the fire exists near the fire onset, the precise nature of 
the surface of these fuel items, local ventilation condition etc. These factors and 
their consequences do not lend themselves easily to theoretical predictions from 
first principles. For this reason, every fire risk assessment faces the challenge that 
the probabilities and initial development of relevant fire scenarios can currently not 
be predicted with theoretical models. 

A solution to this problem is to define a limited set of design fire scenarios that, 
based on service experience and expert judgment, are deemed to contain the ma- 
jor risk contributions and assign probabilities to each scenario based on experience, 
judgment and available fire statistics. This simplified approach is acceptable ac- 
cording to international standards and guidelines (ISO, 1999, SFPE 2000). A more 
rational approach was chosen in the present case. The design solutions that were 
considered for the alternative design were restricted to those options that would not 
change the probability of ignition and the initial development of a fire compared to 
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that implied by the prescriptive fire requirements of SOLAS. How this was done 
was explained before. This ensures that the occurrence probability of a significant 
fire would be the same as that of traditional steel designs. This probability can be 
estimated from available fire accident statistics for ships and therefore need not be 
predicted from theoretical models or assigned based on judgment. 

With this approach, an initial event being the occurrence of a significant fire 
could be defined with a probability that can be estimated from historic records. 
Furthermore because the composite superstructure model is located in the fore ship 
far away from the engine room, one can assume that the novel design would not 
affect engine room fire scenarios. Hence, only a subset of the fire accident statistics 
needs to be considered. 

Statistics for historic fires can be established from Lloyd’s Register — Fairplay 
(online). Such statistics were compiled and reported by Vanem and Skjong (2004a). 
According to their results the probability of a significant superstructure fire for this 
ship type is 5.6 10+ per ship year. This probability is dominated by accidents 
that occurred before the latest amendments to the fire safety regulations where e.g. 
sprinkler systems became mandatory. Taking account of the reliability of sprinkler 
systems (Hall 2006), an improved estimate of this probability for current ships of 
5 10-> per ship year was established and used for the risk assessment. 

From the initial event (occurrence of a significant superstructure fire), a range 
of 25 distinct fire scenarios were developed and together formed an event tree rep- 
resenting all the fire scenarios considered relevant. In this way, the risk model ac- 
counted for all fires from the small ones making little damage to uncontrolled fires 
that, due to the effectiveness of the adopted RCOs are very rare indeed, but if occur- 
ring would lead to severe consequences. Escape simulations were performed to es- 
timate the required safe egress time. Small scale fire tests (Fig. 6.3) were performed 


Fig. 6.3 Small scale tests performed at SP (Sweden) to provide inputs to fire simulations 
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300 seconds 


Fig. 6.4 Results from unpublished simulations performed by CETENA of fires in the cafeteria and 
a corridor 


to obtain input data for fire simulations. Fire simulations (Fig. 6.4) predicted the 
development of significant fires and the propagation of heat and smoke in the spec- 
ified fire scenarios. This could be compared to the results from the escape simula- 
tions to establish the risks associated with escape from the fire zone. Full scale fire 
test trials established the fire resistance of structural components such as decks and 
bulkheads (Fig. 6.5) including cable, pipe and duct penetrations (Fig. 6.6) and the ef- 
fectiveness of fire rated windows and doors and external drencher system (Fig. 6.7) 
as RCOs. All fire tests were continued beyond the intended survival time thus pro- 
viding information about the true capacity that was used in the risk modeling. Fur- 
thermore, the effects of human decisions such as the captain’s decision to abandon 
ship were included in the risk model. On that basis also the risks associated with 
the later stages of escalating fires were estimated. Making use of advice from the 
group of experts, this produced the conditional probabilities and consequences of all 


Fig. 6.5 Fire resistance test performed at Sintef (Norway) of a balsa-cored bulkhead that survived 
2h 20 min 
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Fig. 6.6 Fire resistance test performed at SP (Sweden) of bulkhead with cable, pipe and AC duct 
penetrations 


the events in the event tree. This allowed to estimate the consequences in terms of 
expected number of fatalities both among those nearby the initial fire being exposed 
to risk on their escape from the fire zone and those safely mustered that would be 
exposed to risks in the unlikely event of an escalating fire getting out of control. The 
risk contributions were updated for the RCOs such that the effect of adopting the 
RCO on risk could be quantified. 


Fig. 6.7 Full scale fire test trial performed at SP (Sweden) demonstrating the efficiency of a 
drencher system in preventing external fire propagation when an internal fire exits through a broken 
window 
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6.1.4 Results of Fire Risk Assessment 


Application of the fire risk model to the base design provided an estimate of the 
superstructure fire risk associated with it. All individual risk criteria were met. 
A superstructure fire PLL of 0.016 was estimated. This is above the limit speci- 
fied for societal risk and may be regarded unacceptable. The effects of a range of 
RCOs were estimated using the risk model. Figure 6.8 shows the estimated effects 
of the most promising RCOs. For comparison, the historic PLL from collision and 
grounding as well as fire are shown. The historic fire PLL includes contributions 
from all fires, also those that would not be caused by the superstructure fire (e.g. 
engine room fires) and is dominated by accidents that occurred before the latest 
amendments to the fire safety regulations. An attempt was made at correcting these 
two factors producing a lower and an upper bound estimate of the PLL due to super- 
structure fires in current steel designs. These estimates are also shown in Fig. 6.8. 
The upper bound coincides with the target PLL defined in Table 6.1. Figure 6.8 
shows that the risk of the base design is above the specified acceptable societal risk 
(PLL) but that implementation of the most effective RCOs brings the PLL below 
the target such that it compares favourably with that of traditional steel designs. 

The main reason why the risk of the composite superstructure is less than that 
estimated for steel superstructures is that the use of fire rated windows and doors 
increases the probability that a fire inside the superstructure will be contained inside 
and thus not expose passengers and crew. 
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6.1.5 Benefits of the Risk Based Design 


The composite design offers considerable weight-saving. Table 6.2 shows a compar- 
ison of weights and new-build costs of a steel design compared with two alternative 
composite designs for the case used in the first step of the study. About 60% weight 
saving compared to the steel superstructure was estimated for the second composite 
design. The costs and weights include all the differences between the steel and com- 
posite designs such as fire insulation and deck coverings and can thus be compared 
directly. The estimated weight saving is likely to be attractive at the estimated cost 
if increased payload can be achieved for the particular project considered. 


Table 6.2 Summary of weights and new-build costs of a steel design compared with two alternative 
composite designs for the case used in the first step of this study 


Weight (tonnes) New-build cost (mill USD) 

Superstructure Saving Superstructure Increase 
Steel reference design 950 0 4 0 
Composite design | 440 510 All 3,1 
Composite design 2 360 590 6,9 2,9 


6.1.6 Discussion 


Simplifying assumptions were made in the risk assessment. One may replace some 
of these assumptions with more detailed simulations or test trials to provide more 
accurate estimates of conditional probabilities or consequences in the various fire 
scenarios and hence also more accurate risk estimates. However, the risk contri- 
butions from the various fire scenarios are all conditional upon the occurrence of 
a significant superstructure fire. The historic occurrence frequency of significant 
superstructure fires is indeed quite small. Hence one may conclude that that the sen- 
sitivity of the fire risk estimates to uncertainties in the conditional probabilities or 
consequences of the subsequent events is limited for alternative designs where the 
deviation from the prescriptive fire safety requirements do not alter the occurrence 
probability of significant superstructure fires. This implies that it would not be cost 
effective for such designs to invest a great effort at improving the fire risk estimates. 
If shipping safety is the concern, it would certainly be more useful to spend those 
resources on improving the understanding of more significant risks such as those 
due to collisions and groundings. This suggests that the level of rigor employed in 
the risk assessment is sufficient for the intended purpose. 

The IMO guidelines on alternative design and arrangements for fire safety IMO 
2001) require that the effects of the uncertainties and limitations of the input pa- 
rameters are determined by a sensitivity analysis. In the present case a probabilistic 


314 Dag McGeorge et al. 


analysis was used. It explicitly includes uncertainties in the input parameters used 
to characterise the design fire scenarios and quantifies the effects of these uncer- 
tainties. Therefore, the probabilistic approach provides a direct and rational way of 
satisfying the requirement to perform a sensitivity analysis. However, simplifying 
assumptions and simplified models were needed to complete the assessment within 
reasonable budgets and time limits even with the probabilistic approach. Therefore, 
it is important also to assess the sensitivity of the conclusions to the uncertainties 
introduced by those simplifications. This was done by changing the best available 
estimates of probabilities and consequences with values that were considered obvi- 
ously pessimistic. This did neither raise the individual or societal risk estimates into 
the intolerable region nor did it make additional RCOs cost effective. Therefore, it 
is considered that the reported conclusions are robust with regard to uncertainties 
and limitations of the input parameters. 

All the RCOs that were cost effective according to the CAF criterion were 
adopted. In addition, some RCOs that were somewhat less cost effective were 
adopted although that would not strictly be required. Those RCOs were inexpensive 
and did not significantly affect the cost of the superstructure module. They were 
adopted because they were considered to provide the margin necessary to ensure 
safe use of the new technology also for other slightly different design cases. Hence, 
the technology described herein is likely to have wider application than the design 
cases studied and could provide a useful basis for a possible future risk-based stan- 
dard for composites in passenger ship superstructures should the ongoing work with 
the international regulatory regime allow that in the future. Under the current regu- 
lations, however, the fire risks would have to be assessed in each individual case. 


6.1.7 Conclusions 


Current state of the art composite sandwich technology was used to develop a base 
design for a large superstructure module for a RoPax passenger ship. The weight of 
this light-weight design proved to be only about 40% of that of a traditional steel de- 
sign. However, a risk assessment showed that, although individual risks were accept- 
able, the societal risk was not. A risk based design process was performed leading 
to the identification of a set of risk control options deemed cost effective. Adopt- 
ing these risk control options reduced the risk to acceptable levels that compare 
favourably with steel designs compliant with current prescriptive SOLAS require- 
ments. Such a lightweight design could be regarded an alternative arrangement as 
defined in SOLAS and could therefore be approved according to SOLAS Ch II-2 
Reg. 17. This gives promise for more efficient and profitable merchant ship designs 
in the future. Furthermore, the present work provides a useful basis for a possible 
future risk-based standard for composites in passenger ship superstructures should 
the ongoing work with the international regulatory regime allow that in the future. 
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6.2 RBD Application: AFRAMAX Tanker Design 
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Abstract Following a series of catastrophic single hull tanker accidents, currently 
in force IMO regulations (and long before U.S. OPA90, National Research Council, 
1991) recognize double hull tanker designs as the only acceptable solution for the 
safe carriage of oil in tanker ships. The resistance towards the acceptance of alterna- 
tive double hull tanker designs by the authorities has been limiting creativity within 
the industry, though currently in force MARPOL requirements appear challengeable 
without increasing the risk of negative environmental impact. 

The herein presented study refers to a risk-based parametric optimization of a 
double hull AFRAMAX tanker within a holistic design optimization concept aiming 
to achieve innovative designs with increased cargo carrying capacity and improved 
environmental protection, while challenging the cargo tank size limitations imposed 
by the existing IMO-MARPOL regulations. 


6.2.1 Introduction 


The main objective of the presented work is the introduction of an innovative tanker 
design that challenges some MARPOL requirements (IMO, 2003) and promises sig- 
nificant economical advantage as well as lower potential of medium to large amount 
of oil spills. 

The study presented herein focused primarily on optimizing only the main cargo 
area of an AFRAMAX class tanker in order to demonstrate the best performing 
design in terms of improving both environmental protection from accidental oil 
outflow and economical competitiveness. However, further development of the in- 
troduced methodology to include more optimisation objectives, such as ship’s hull 
form, including main dimensions and other tanker classes appears straightforward. 

For the design concept development stage, a full parametric multi-objective de- 
sign optimisation platform has been developed, implementing interfaces between 
standard naval architectural software packages and optimization techniques (herein 
of Genetic Algorithms) and taking into account probabilistic oil outflow calculation 
methods for side and bottom damages. The resultant Pareto-optimal designs are 
evaluated in terms of oil outflow consequences, cargo capacity, design feasibility, 
ship maintainability and ballast water capacity. 

The developed alternative designs dispose, compared to a standard AFRAMAX 
double hull design, increased cargo carrying capability, at a comparable or even 
slightly reduced risk for oil outflow. Therefore, from the economy and safety point 
of view, the resulting designs appear very promising compared to existing standard 
type AFRAMAX double hull designs. A preliminary economic analysis showed that 
despite the anticipated slightly increased building cost, the developed alternative 
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designs show an appreciable decrease of unit transport cost, making them attractive 
to the shipping industry. 

The presented research study was undertaken in the framework of the EU funded 
project SAFEDOR (2005-2009). 


6.2.2 Introduction to Holistic Ship Design Optimization 


Ship design was in the past more art than science, highly dependent on experienced 
naval architects, with good background in various fundamental and specialized sci- 
entific and engineering subjects, next to practice. The design space was practically 
explored using heuristic methods, namely methods deriving from knowledge gained 
through a process of trial and error often over the course of decades. 

Inherently coupled with the design process is design optimization, namely the 
selection of the best solution out of many feasible ones on the basis of a crite- 
rion, or rather a set of criteria. Considering the ship over her whole life cycle 
as a system, consisting of the processes/stages of concept/preliminary design — 
contractual/detailed design — ship construction/production — operation — scrap- 
ping/recycling, it is evident that the optimal ship with respect to her whole life cycle 
is the outcome of a holistic! optimization of the entire, above defined ship system. It 
is noted that mathematically, every constituent of the above defined life-cycle ship 
system forms evidently itself a complex nonlinear optimization problem for the de- 
sign variables, with a variety of constraints and criteria/objective functions to be 
jointly optimized. Even the simplest component of the above system, namely the 
1st loop (conceptual/preliminary design), is complex enough to be simplified (re- 
duced”) in practice. Also, inherent to ship design optimization are the conflicting re- 
quirements resulting from the design constraints and optimization criteria (merit or 
objective functions), reflecting the interests of the various ship design stake holders: 
ship owners/operators, ship builders, classification society/coast guard, regulators, 
insurers, cargo owners/forwarders, port operators etc. Assuming a specific set of 
requirements (usually the shipowner’s requirements), a ship needs to be optimized 
for lowest construction cost, for highest operational efficiency or lowest Required 
Freight Rate (RFR), for highest safety of passengers/crew, for satisfactory protec- 
tion of cargo and the ship herself as hardware and last but not least, particularly for 
oil carrying ships, for minimum environmental impact. Many of these requirements 
are clearly conflicting and a decision regarding the optimal ship design needs to be 
rationally made. 


' Principle of holism according to Aristotle (Metaphysics): “The whole is more than the sum of 
the parts”. 

? Principle of reductionism may be seen as the opposite of holism, implying that a complex sys- 
tem can be approached by reduction to its fundamental parts. However, holism and reductionism 
should be regarded as complementary approaches, as they are both needed to satisfactorily address 
complex systems in practice. 
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Since the middle sixties with the advance of computer hard- and software more 
and more parts of the design process were taken over by computers, particularly 
the heavy calculatory and drafting elements of ship design. Simultaneously, the 
first computer-aided preliminary design software systems were introduced, deal- 
ing with the mathematical parametric exploration of the design space on the basis 
of empirical/simplified ship models for specific ship types or the optimization of 
design variables for specific economic criteria by gradient based search techniques 
(Murphy et al. 1965, Nowacki et al. 1970). Also, computer-aided studies on opti- 
mization of ship’s hull form for least resistance and best seakeeping behavior (hy- 
drodynamic design optimization) or of ship’s midship section/structural design for 
least steel weight (structural design optimization) started being introduced to the 
naval architectural scientific community until they led to matured results in more 
recent years (see, e.g., Papanikolaou et al. 1996, Boulougouris and Papanikolaou 
2006, 2008). 

With the further and faster advance of computer hard- and software tools, along 
with their integration into powerful hard- and software design systems, the time 
has come to look at the way ahead in ship design optimization in a holistic way, 
namely by addressing and optimizing several and gradually all aspects of ship’s life 
(or all elements of the entire ship life cycle system), at least the stages of design, 
construction and operation; within a holistic ship design optimization we should 
herein also understand exhaustive multiobjective and multiconstrained ship design 
optimisation procedures even for individual stages of ship’s life (e.g. conceptual 
design) with least reduction of the entire real problem. Recently introduced scien- 
tific disciplines in the general framework of “design for XXX”, namely “design for 
safety” (SAFEDOR 2005-2009, Vassalos 2007), “design for efficiency”, “design 
for production”, “design for operation” etc. indicate the need for approaches and 
the availability of matured methods and computational tools to address holistically 
the ship design optimization problem (Papanikolaou 2008). 

The use of Genetic Algorithms (GA), combined with gradient based search 
techniques in micro-scale exploration and with a utility functions technique for the 
design evaluation, is advanced in the present work as a generic type optimization 
technique for producing and identifying optimized designs through effective ex- 
ploration of the large-scale, nonlinear design space and a multitude of evaluation 
criteria. Several applications of this generic, multi-objective ship design optimiza- 
tion approach by use of NTUA-SDL?’s design software system, integrating the 
naval architectural software package NAPA®%, the optimization software mode 
FRONTIER®>® and various application software tools, as necessary for the evalu- 
ation of stability, resistance, seakeeping etc. may be found in the listed references. 
For the general concept and details of multi-objective optimisation by use of Genetic 
Algorithms and alternative procedures reference is made to C. Lucas (2007), “Prac- 
tical Multiobjective Optimisation”, http://vww.calresco.org/lucas/pmo.htm. 


3 National Technical University of Athens — Ship Design Laboratory, NTUA-SDL, http://www. 
naval.ntua.gr/sdl. 


4 NAPA Oy (2005), NAPA software, http://www.NAPA.fi/. 
5 E.STE.CO (2003), “modeFrontier software v.2.5.x”, http://www.esteco.it/. 
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6.2.3 Design Optimisation Procedure 


The optimisation of the internal hull space arrangement of a tanker ship requires 
meeting a set of several different objectives, which are often conflicting and non- 
commensurable. This problem can be effectively addressed by multi-objective op- 
timization methods, which yield first a family of non-dominated solutions (also 
named non-inferior or admissible), the so-called Pareto-optimal set. The concept 
of non-dominance refers to the solutions for which no objective can be improved 
without worsening at least one of the other objectives. Thus, the non-dominated so- 
lutions are superior to the others with respect to all objectives, while comparatively 
good among themselves. Since all the non-dominated solutions in the Pareto set are 
considered equivalent in dominance, any of them is an acceptable solution. Once 
such designs are found, it usually requires a ranking based decision-making tech- 
niques to choose one of them for further elaboration. The rational choice of one 
solution over the other Pareto-Optimal Design Alternatives (PODAs) entails addi- 
tional knowledge of the problem such as designer/shipowner preferences or shipyard 
production experience. 

As designers’ or other experts’ fuzzy opinions, which can be linguistic terms, 
cannot be taken into account in the optimisation stage because of its crisp nature, 
ranking or evaluation of PODAs is considered as a fuzzy multi-attributive group 
decision-making problem. To this effect various solutions can be exercised to arrive 
in more rational decisions in the final design selection process. A Multi-Criteria 
Decision Making (MCDM) procedure might be employed to address this effectively, 
introducing a new single objective function by use of so-called utility functions and 
enabling the systematic evaluation of the PODAs by a computerized procedure. 

In this study in order to test and demonstrate a risk-based design platform for 
tanker ships, various design concepts are implemented within a tailored-made op- 
timisation platform capable of measuring relative environmental impact of a given 
set of design variations. A schematic process flow of the implemented tanker design 
optimisation procedure is given in Fig. 6.9. 

Firstly a set of design objectives are defined which are indicative of the per- 
formance of a tanker ship in relation to accidental oil spill potential and carrying 
capacity. The design team has decided on a number of target design parameters to 
focus on to meet the objectives determined together with the design constrains. The 
specially developed optimisation platform consists mainly of two parts; a design 
package and an optimisation package, which are adapted to the problem to produce 
design alternatives and arrive at a series of PODAs. 

The optimisation work-flow is herein modelled in the modeF RONTIER® 
software environment. A parametric and topological NAPA® (Naval Architectural 
Software) model of the AFRAMAX vessel definition is developed so that the ref- 
erence vessel layout can be developed for each design experiment with respect to 
the defined optimisation parameters. Therefore, for each design layout (or design 
experiment), the design package employs the NAPA® software suit to produce the 
desired design from given set of parameters. Then it calculates and checks the de- 
sign features in relation to the cargo block, to be optimized and the tank capacities. 
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Fig. 6.9 Implemented tanker design optimisation procedure 


Following this, the design is evaluated by a specially developed oil outflow mod- 
ule of HECSALV®® software suite in terms of oil outflow performances. The same 
calculations can be performed independently within the NAPA® software suite. 

The optimisation platform utilizes a genetic algorithm based multi-objective op- 
timisation methodology of the FRONTIER software suite, namely MOGA, where 
the solution space is searched for a set of PODAs through a satisfactory number of 
generations from an initial number of design experiments. 


6.2.4 Reference Vessel 


The reference vessel, code-named as “Double Venture’, is a double hull construc- 
tion ship of AFRAMAX size. “Double Venture” fully complies with the current 
regulations and is still in operation. In Table 6.3, the basic characteristics of the 
vessel are presented. 


6 HECSALV® , http://www.herbertsoftware.com. 
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Table 6.3 Reference vessel 


Length, oa 250.10 m 

Length, bp 239.00 m 

Breadth, moulded 44.00 m 

Depth, moulded (main deck) 21.00 m 

Width of double skin sides 2.50m 

Width of double skin bottom 2.50m 

Draught scantling 14.60m 

Deadweight, scantling draught (comparable with 109,800 dwt (cargo density 
design proposed) 0.868 T/ m) 

Cargo capacity 

Liquid volume, 122,375m? +2,830m% (Slop), 

heavy oil, diesel oil, 3,380m>, 260m? 

Water ballast 41,065 m3 + 3, 500m? (peaks) 

Classification Lloyds Register 

Propeller Diameter 7,200 mm 

Number of Cargo tanks 12 plus 2 slop tanks 

Cargo Tanks block length 181.44m 


The vessel is single-decked without forecastle. A double skin construction is ar- 
ranged along the cargo length area, consisting of six (6) pairs of side and bottom 
tanks for use of water ballast. The cargo tanks area has a longitudinal bulkhead 
and is subdivided into six pair of tanks for the carriage of crude oil and products, 
Fig. 6.10. Two slop tanks are also provided, afterwards of main cargo area. Cargo 
handling is by means of centrifugal pumps installed in a pump room, which is lo- 
cated forward of the machinery space. It is noted that the above reference double hull 
design disposes an increased double side and bottom clearance of 2.5m, compared 
to the minimum 2.0 m required for this size of ship according to MARPOL relevant 
requirements, thus it does not only comply with but exceeds minimum requirements 
set by currently in force regulations (IMO, 2003). 


Fig. 6.10 Reference vessel “Double Venture” 
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Crew accommodation is arranged in a deckhouse above the engine room, sepa- 
rated from the funnel casing to reduce possible noise and vibration problems. The 
reference vessel “Double Venture” was also used in another EU funded project 
POP&C (2004). Due to commercial confidentiality, full details of ship’s particulars 
are not given at this publication 


6.2.5 Concept of Design Study 


6.2.5.1 Safety Goals 


The present design study addressed the following specific safety objectives: 


Reduction of potential of medium to large amount oil spills significantly. 
Eliminate small size oil spills due to operational incidents/accidents 
Significantly reduced ballast water exchange and their effects. 

Zero-fatality and injury rate for tanker operations. 

Prolonged-maintenance-free structural life, and easy inspection and assessment 
of structure. 


6.2.5.2 Challenges in the Proposed Design 


In developing a promising design concept for an AFRAMAX tanker that will sat- 
isfy the set safety objectives, prove attractive to the maritime industry and be ac- 
ceptable to regulators, a variety of known design alternatives and hybrids thereof 
were considered. It was finally decided to consider herein only possible variations 
of the double hull design concept that is nowadays generally accepted as a tanker 
industry design standard. The new design will be developed by using principles of 
risk-based design and will be enhanced with special subdivision considerations for 
optimal economic and environmental performance. The optimum location, size and 
configuration of cargo and ballast tanks will be obtained through analysis of oil out- 
flow calculations; mainly considering zero, mean and extreme outflow rates using 
the probabilistic oil outflow framework, together with economical implications on 
the design layout. 

Several alternatives have been studied and the most significant layouts are pre- 
sented in the next paragraphs. The main characteristic of the proposed alternatives 
is the increase of double bottom height in the fore part of the ship, where accidents 
are more probable (mainly due to groundings), as well as the rational redistribution 
of transverse bulkheads in order to minimize the oil outflow in case of oil spill. 

Considering different design alternatives and possible challenges of existing 
regulations, it appeared realistic that the proposed design layout should challenge 
herein only the regulation MARPOL 73/78, Annex 1/26, that is related to the lim- 
itations of size and arrangement of cargo tanks, namely “maximum length of each 
cargo tank should not exceed 0.2L”. 
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The proposed design alternatives should be economically attractive and prove 


even safer than a conventional one complying with the above mentioned regulation, 
taking advantage of a more rational distribution of the double skin and double bot- 
tom bulkheads, while increasing protection and limiting tank size in the areas most 
susceptible to suffering damages due to grounding and side collision. 


Advantages of New Proposals 


i, 
2 


Improved performance in case of accidental oil outflow. 
Increase of cargo capacity taking advantage of hull volume in areas where the 
probability of damage is low. 


. Decreased amount of segregated ballast water when compared to a conventional 


design, as a result of the cargo capacity increase. 


Disadvantages of New Proposals 


1, 


2. 


Slightly higher bending moments and shear forces due to capacity changes ob- 
served in ballast water and cargo tanks. 

Partly increased complexity in building some double skin and double bottom 
bulkheads, leading probably to increase of fabrication costs. Although not studied 
in details, an increase of steel weight and cost is expected. 


. Some restrictions different from the conventional ones will be imposed to hull 


form design since aft trimming tendencies were observed by using the hull lines 
of the reference vessel. To address this issue, modifications of the buoyancy dis- 
tribution are required and consequently investigation of ship’s hydrodynamic be- 
haviour shall be studied in the future. It is likely that shifting the LCB aft will 
have an adverse impact on the powering and fuel costs. 


6.2.6 Overview of Design Problem 


The design objectives of the present study can be summarized as follows: 


Increased cargo capacity as much as possible while maintaining the same main 
vessel characteristic. 

Optimized overall oil outflow performance. 

Reduction of fabrication costs by designing a production-oriented ship structure. 


The main design and optimisation characteristics are described below: 
Type of vessel: “Double Hull” AFRAMAX tanker. 
General Arrangement: An optimized layout is proposed as well as the number 


of cargo tanks depending on the outflow optimisation study. Water Ballast tanks, 
Double Bottom and Double Sides dry spaces to be optimized as well. 
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Initial Main Dimensions Length 239 m (as reference vessel) 
Breadth 44 m (as reference vessel) 
Depth 21 m (as reference vessel) 
Design draught: around 13.6m 
Scantling draught: min. 14.6 m 

Width of double skin Sides clearance to be optimized 
Double bottom height to be optimized 


Deadweight/Tonnage (as reference vessel) 

Design Deadweight: around 100,000 tonnes 

Scantling Deadweight: according to Lightship weight 
calculations and a minimum cargo density of 
0.855t/m> 


Cargo/other capacities: | Liquid Cargo Volume: amount to be opti- 
mized, reference vessel (127,444 m*) 
Heavy oil: 3, 380m? (as ref. vessel) 
Diesel oil: 260 m3 (as ref. vessel) 
Water ballast: amount to be optimized. 


6.2.7 Design Optimization Case Study 


The reduced environmental impact and increased cargo capacity are sought by de- 
termining the best double hull dimensions for the given reference vessel. The hull 
surface of the reference vessel is taken unchanged and the optimisation procedure is 
carried out for three models, namely Model 1-3. The tank configuration layouts are 
given in Figs. 6.11, 6.12 and 6.13 respectively. 


Model 1: Basic Double Hull model, with a single longitudinal bulkhead at cen- 
tre line. 

Model 2: Segregated Ballast Tanks-Protectively Located (SBT-PL) model with 
large side tanks, central cargo tanks and two longitudinal bulkheads. 

Model 3: Hybrid model — Basic Double Hull Model, but with two longitudinal 
bulkheads. 


In the initial optimisation search, the cargo block length, which runs from —73.02 
to 108.42 m with reference to amidships, is kept constant. Therefore, the aft area of 
the Cargo Tank 6 is kept unchanged, where the engine room, pump room, slope 
tanks, service tanks and accommodation spaces are located. The forward area of the 
Cargo Tank | is kept unchanged as well. 

Further design search was conducted for a model where cargo block length is 
varied by moving the aft limit of the Cargo Tank 6. In this case, the engine room 
area and superstructure need modifications in order to allow for the lengthening of 
the cargo block. However, the forward area of the Cargo Tank | is in all cases kept 
unaffected. 
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Fig. 6.11 Basic double hull model, 6 x 2 cargo tanks configuration, Model | 


The basic parametric tank configuration model introduced a sloped double bot- 
tom height increase, Fig. 6.14. In a second parametric model alternative (see later 
results for Long310-01), the deck height increases by a linear sheer, following the 
slope of the double bottom, thus regaining the lost cargo volume due to the double 
bottom height increase. 


Fig. 6.12 SBT-PL model- Large side tanks and central cargo tanks, 6+4 cargo tanks configuration, 
Model 2 
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Fig. 6.13 Hybrid model — traditional double skin with two longitudinal bulkheads, 6 x 3 configu- 
ration, Model 3 


Fig. 6.14 Parameters defining double bottom height for cargo block 


With respect to Model 1| and 2, the cargo tanks are bounded by L-shaped wing 
tanks, Fig. 6.15. In case of Model 2, a longitudinal bulkhead is used instead of 
double skin construction. Fig. 6.16 demonstrates the parameters controlling the 
cargo tank lengths. The length values are used as normalized by the total length 
of the cargo block. 


r sw 
Fig. 6.15 Parameters defining }dbh 
double hull and size of tanks anes == e SERN 
in cargo block t 
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length 6 


——— « >< —>+— —><« > 
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Fig. 6.16 Parameters defining length of the cargo tanks; length 1-6 
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All the parameters used to control the cargo block configuration are given in 
Table 6.4 as optimisation variables. For different generation generations, different 
limit and range values are used in the optimization search; those are given in paren- 
thesis. 


6.2.7.1 Implemented Optimisation Objectives 


Considering the primary focus of the design concept, the following optimisation 
objectives were finally implemented: 


Maximization of Cargo Capacity 
Minimization of Mean oil outflow 
Maximization of Probability of Zero outflow 
Minimization of Lightweight 

Maximization of Dry void spaces 


6.2.7.2 Implemented Optimization Constraints and Assumptions 


In order to perform a reasonably rational design comparison for alternative designs, 
a series of constraints and assumptions are taken into consideration. Most of the 
assumptions are taken because although they do not affect the design search and 
selection process, they reduce the computational efforts significantly. Synoptically, 
the following constraints and assumptions were implemented: 


e The hull shape is kept unchanged for each employed parametric Model with 
respect to the reference vessel 

e All parts are kept as they are in reference vessel except for the cargo block area. 
In a second stage, the cargo block area is lengthened; therefore the aft part of the 
vessel is altered. 

e The aft and forward spaces are simplified to reduce the calculation time. 

e The ship’s draught is assumed the same, when considering bottom oil outflow for 
comparison, but is actually varying to account for cargo capacity and light ship 
weight increase. 

e Cargo oil density was assumed 0.855 t/ m 

e Cargo tanks are fully loaded at 98% of their total capacity. 

e Side and bottom damage probability distributions are considered in accordance 
to MARPOL 73/78 relevant requirements. 

e Survivability criteria are determined according to recommended survival s-factor 
from the new harmonized probabilistic damage stability regulations IMO 2005, 
Tuzcu 2004, Moore 2006). 

e No tidal effect is introduced. 
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Table 6.4 Optimisation variables 
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A ji Lower Upper 
Variable Explanation Type eure Se Increment 
Layout type | 0: Double Hull, 1: SBT-PL Discrete 0 1 - 
PY: ee 0 0 - 
Long bh 7 sicko eel a Continuous (5) (15) (5) 
a (8) (10) (0.25) 
Double Bottom height for , ; 
dbh 1 Cargo Tank 1 Area Continuous 1.9 5 0.1 
sw | Side wing tank clearance Continuous 1.7 3.0 0.1 
: Length of Cargo Tank | . ; 
Length | / Length of the cargo block Continuous 0.1 0.3 0.05 
Centre | 0: Ballast Tank, 1: Cargo Tank Discrete 1 = 
Side 1 0: Ballast Tank, 1: Cargo Tank Discrete 1 = 
Double Bottom height for F ; 
dbh 2 Cargo Tank 2 Area Continuous 1.9 5 0.1 
sw 2 Side wing tank clearance Continuous 1.7 3.0 0.1 
Length of Cargo Tank 2 . ; 
Length 2 / Length of the cargo block Continuous 0.1 0.3 0.05 
Centre 2 0: Ballast Tank, 1: Cargo Tank Discrete 0 1 = 
Side 2 0: Ballast Tank, 1: Cargo Tank Discrete 0 1 = 
Double Bottom height for ‘ ; 
dbh 3 Cargo Tank 3 Area Continuous 1.9 5 0.1 
sw 3 Side wing tank clearance Continuous 1.7 3.0 0.1 
Venath3 Length of Cargo Tank 3 : ; 
gth 3 / Length of the cargo block Continuous 0.1 0.3 0.05 
Centre 3 0: Ballast Tank, 1: Cargo Tank Discrete 0 1 al 
Side 3 0: Ballast Tank, 1: Cargo Tank Discrete 0 1 = 
Double Bottom height for : : 
dbh 4 Cargo Tank 4 Area Continuous 1.9 5 0.1 
sw4 Side wing tank clearance Continuous 1.7 3.0 0.1 
Length of Cargo Tank 4 ‘ , 
Length 4 fiLencth ofthe caroitilock Continuous 0.1 0.3 0.05 
Centre 4 0: Ballast Tank, 1: Cargo Tank Discrete 0 1 - 
Side 4 0: Ballast Tank, 1: Cargo Tank Discrete 0 1 - 
Double Bottom height for F ; 
dbh 5 Cargo Tank 5 Area Continuous 1.9 5 0.1 
sw 5 Side wing tank clearance Continuous 1.7 3.0 0.1 
Leneth 5 Length of Cargo Tank 5 . 
g / Length of the cargo block Continuous 0.1 0.3 0.05 
Centre 5 0: Ballast Tank, 1: Cargo Tank Discrete 1 - 
Side 5 0: Ballast Tank, 1: Cargo Tank Discrete 1 = 
Double Bottom height for : 
dbh 6 © Cont s i: 5 0.1 
Cargo Tank 6 Area aia s 
sw 6 Side wing tank clearance Continuous 1.7 3.0 0.1 
Length of Cargo Tank 6 F : 
Length 6 / Length of the cargo block Continuous 0.1 0.3 0.05 
Centre 6 0: Ballast Tank, 1: Cargo Tank Discrete 0 1 - 
Side 6 0: Ballast Tank, 1: Cargo Tank Discrete 0 1 - 
Aft limit Aft limit of Cargo Block Continues (-88.14) (73.02) G.78) 
Fwd limit Forward limit of Cargo Block Constant 108.42 - - 
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Implementation of Optimization Procedure 


Figures 6.17 and 6.18 present the implemented risk-based tanker design optimiza- 
tion procedure as flow chart and block diagram. 


Parametric Layout Models 


Main Optimisation Parameters 
Optimisation Constraints 
Optimisation Objectives 
Pareto-Frontiers 


Economical Impact Study 
Design Selection 
Process Environmental Impact Study 


Detailing the selected design(s) 
Prepare Zero-outflow design for reference 


Final Report Delivery 
Design Presentation 
Phase | - Complete 


Fig. 6.17 Implementation of optimization procedure 
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6.2.7.3 Search of Design Resultant Domains 


After running the model with respect to the given parameters and objectives, a 
series of alternative design spaces are obtained. Through filtering of the solution 
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* Side Tank purpose (ballast or cargo) 
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OWNER 
REQUIREMENTS 
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* Hull shape 

* Maximum Draft 

* Displacement 

* Initial Arrangement 


CONSTRAINTS 


* Arrangements apart from the cargo block 
* Cargo oil density and tanks fully loaded capacity 

* Side and bottom damage probability distributions 
* Survivability criteria acc. to new harmonised 
probabilistic damage stability regulations for cargo 
ships (HARDER project) 


Fig. 6.18 Risk-based tanker design optimization 


spaces, several designs are determined as Pareto-optimum designs. It was evi- 
dent that Model 2 provided the least attractive design solutions due to larger 
mean oil outflow characteristics despite the potential increase in cargo carrying 
capacity. 

As a result of the optimization process, the best performing design solution space 
proved to be associated with Model 1. As it is expected, Model | provides better 
side damage performance. Model 2 was characterized as the worst in terms of mean 
oil outflow due to side damage, resulting in a necessity of increasing the number 
of tanks to obtain better oil outflow damage for side damage cases. This alternative 
would increase ship’s lightweight significantly and consequently it is not considered 
herein further. A similar conclusion was obtained for Model 3 where the lightweight 
increases due to one additional longitudinal bulkhead. Increased cargo and ballast 
tank surfaces for coating and maintenance are considered as one of the disadvan- 
tages of the designs produced by Model 2 and Model 3. 

A fairly large design search has been finally carried out with respect to Model 1 
which demonstrates better oil outflow performance per capacity, with limited cargo 
and ballast tank area values. Model | is further optimized by increasing the cargo 
block length as stated before. The research domain initiated by utilizing good de- 
signs from the early generations where the cargo block length was fixed. The par- 
ticular design search domain is presented in Fig. 6.19. The elaboration of the other 
two basic design models remains to be explored in further studies. 


6.2.7.4 Selected Pareto-Optimal Design Alternatives 


Further evaluating the design studies, several Pareto-Optimal designs are selected 
from the solution domains. The particular selected designs are listed in Appendix 
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» Po Side 
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- Cargo Volume 


~ Cargo Area 


Design ID 


Fig. 6.19 Search domain for Model 1; values are normalized with respect to given reference vessel 


A, Table 6.7. The reference vessel is coded as ID 0 in the particular table. The 
underlined values indicate cases that do not meet the minimum cargo tank length 
requirement specified by the relevant MARPOL regulations. 

After all Pareto-optimal design alternatives have been identified, the next step 
is to evaluate them in relation to economical, safety and environmental impact 
considerations in order to select the best design. The selection of the best design 
should also involve major stake-holders’ preferences. A Multi-Criteria Decision 
Making (MCDM) procedure might be employed to rationalize stake-holders pref- 
erences and address the decision making effectively, introducing a new single ob- 
jective function by use of so-called utility functions; they are enabling the system- 
atic evaluation of the PODAs by a computerized procedure and greatly support the 
decision making. 


6.2.7.5 Resulting Design Alternatives 


Regarding oil outflow performance, several alternatives have been explored. In this 
section, the most interesting resulting designs are briefly commented. 


Alternative 141 


The first selected alternative is the one coded as 141 that features the best oil outflow 
performance and some improvement of capacities, keeping in parallel most of the 
other relevant design features such as hull lines, engine room design, location of 
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Table 6.5 Principle characteristics of alterative 141 


Width of double skin sides 2.10m 
Width of double skin bottom Variable, 2.10 m min. 
Draught scantling 14.60m 


DWT, scantling draught (comparable with 109,800 dwt (cargo density 0.867T/ m°) 
design proposed) 


Cargo capacity 


Liquid volume, 124, 800m? + 2, 830m? (Slop), 
heavy oil, diesel oil, about 3,380m?, 260 2 
Water ballast 38,713 m> +3,500m° (peaks) 
Number of Cargo tanks 12 plus 2 slop tanks 
Cargo Tanks block length 181.44m 


accommodation, etc. unchanged. The main particulars for alternative 141 are given 
in Table 6.5, whereas the basic general arrangement is shown in Fig. 6.20. 

In the particular alternative, the arrangement of engine room as well as the fore 
and aft limit of the cargo block is kept the same as the reference vessel. The dif- 
ference with respect to the reference vessel is in the distribution of load and ballast 
inside the cargo block and tanks length. The selected configuration gives more pro- 
tection to the fore tanks where damages are more probable and also limits the vol- 
ume of tanks situated in the more “risky areas”. Note that the width of double side 
and depth of double bottom are reduced in relation to the reference design (tanks 
5 and 6), allowing to recover the volume lost in the fore part of the ship (tanks 1, 
2 and 3), where the double bottom is raised according to the introduced protection 
philosophy, and even gain some volume with respect the reference design. 

Analyzing the changes introduced in the cargo tanks, it is evident that this con- 
figuration results to the aftward movement of the longitudinal centre of gravity com- 
pared to the reference design. 


Fig. 6.20 Alternative 141: Cargo block sketch 


Alternative Long310 


This is one of the alternatives with the largest improvement in terms of cargo capac- 
ity, at fully satisfactory oil outflow performance. Due to the shortening of the engine 
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Table 6.6 Principle characteristics of alterative Long310 


Width of double skin sides 2.30m 

Width of double skin bottom Variable 

Draught scantling 15.10m 

DWT, scantling draught (comparable with 114,200 dwt (cargo density 
design proposed) 0.855T/m*) 

Cargo capacity 

Liquid volume, 130,43 0m? +2,830m:? (Slop), 
heavy oil, diesel oil, about 3,000 m?,260m°* 
Water ballast 44,344 m? + 3, 500m? (peaks) 

Number of Cargo tanks 12 plus 2 slop tanks 

Cargo Tanks block length 196.56m 


space, this design is associated with a “state of the art” Diesel Electric Drive system, 
which clearly introduces greater flexibility to arrange design layout while keeping 
the main dimensions of the tanker the same. The alternative takes advantage of a 
reduced engine room design offering an important opportunity to increase in cargo 
capacity. Table 6.6 presents the main characteristics of the particular alternative, 
whereas the basic general arrangement is given in Fig. 6.21. 

The required propulsion for alternative Long310 consists of four medium speed 
Diesel Engines Driven Alternators of about 4300 kW and two Electric Motors cou- 
pled through a shaft line to a reduction gear, Fig. 6.22. 

The Lightship weight of Long310 was estimated to be about 21,700 tonnes. The 
volume of cargo gained is located mainly in the aft part of the cargo block area; 
consequently in case of future further development of this particular design, a sig- 
nificant change of hull lines will be performed in order to better balance the actual 
position of longitudinal centre of gravity. 

It must be mentioned that the fuel consumption for the current alternative with 
medium speed engines will be about 7% higher than the consumption of conven- 
tional propulsion with a slow diesel engine. 


Fig. 6.21 Alternative Long310 Cargo sketch 
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Fig. 6.22 Alternative Long310: Engine room sketch 


Furthermore, a redistribution of the accommodation tower would be required to 
allow the arrangement of some technical spaces on the first deck, such as converter 
room and engine control room, noting that after the reduction of the engine room 
length, such spaces could not be located under the main deck. Finally, the strong 
impact of a diesel electric drive with medium speed diesel engines and high number 
of cylinders should be considered in the capital and maintenance/repair costs. 


Alternative Zero Spill Tanker 


Imposing a zero Oil Outflow (“Zero Spill” tanker) as a constraint in the optimization 
procedure for the cargo block area, a design with the following features is found, 
Fig. 6.23: 


1. Inner bulkhead must be positioned in 13.2 m from side shell, in order to have 
zero oil outflow in all statistically probable side damages. 

2. For survival in the extreme damage cases (0.3L damage extent), the cargo area 
must be located within a minimum number of wing compartments. Therefore 
seven (7) wing compartments are needed. 

3. Double bottom tank height must be at least 6.3 m from the bottom shell in order 
to have zero oil outflow due to all statistically probable bottom damages. 

4. For survival in the extreme bottom damage cases (0.8L), the assumed damage 
extent must be limited within the minimum number of possible compartmenta- 
tion; one double bottom tank would be sufficient; however two (2) double bottom 
tanks are needed because of the side damage requirements without any restric- 
tion of being more than two. The resulted double bottom tanks can be used as 
dry spaces or for ballasting purposes. 


The particular alternative has the obvious disadvantage of having a very poor 
cargo capacity, of only 46,000m?. In addition, ballast water must be arranged per- 
manently in order to have adequate immersion of the propeller. 
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Fig. 6.23 Alternative zero oil outflow Cargo sketch 


Design ID 10 


Design alternative ID 10 is an example for increased oil outflow performance by 
raised double bottom height with a forward slope; however the cargo capacity is 
reduced significantly. The double bottom in the cargo block is raised by 2.5m 
towards the forward part of the ship to 4.50m from 2.0m at the aft tank. The 
double side clearance is maintained at 2.5m throughout the cargo block length 
which is the same as the reference vessel. Each cargo tank length is also kept the 
same as the reference vessel. This design is included to demonstrate the sole ef- 
fect of the raised double bottom height for the forward section of the cargo block 
(Fig. 6.24). 


Design ID Long20 


Design alternative ID Long20 is a Double Hull optimized to have the best capac- 
ity together with an increased level of oil outflow performance. The cargo block is 
lengthened by 4 frames which is 15.12 m aftwards. Cargo tanks 5 and 6 fail to meet 
the formal minimum tank length requirements (MARPOL/Regulation 26). The dou- 
ble bottom in the cargo block is raised by 2.50 m towards the forward end to 4.50 m 
from 2.0 m at the aft tank. The double side clearance is maintained at 2.5 m through- 
out the cargo block length (Fig. 6.25). 

Although the lengthening options of 1, 2 and 3 frames are included in the search, 
the best designs were obviously obtained with the maximum possible increase 
which is 4 frames. The design studies demonstrate an example engine room ar- 
rangement for the longer cargo block alternatives. 
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Fig. 6.25 Design ID long 20 sketch 


A list of normalized performance values for the Pareto-optimal design alterna- 
tives is given in tabular form in Appendix A, Table 6.8 for easy comparison. 


6.2.7.6 Comments on the Presented Alternatives 
For the selected design alternatives no major technical problems were found. Some 


adjustments should be made in more detailed design stages in order to harmonize 
the structural configuration of the ship against common production methods. Also, 
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potential modifications to hull lines are suggested in order to achieve an optimal 
trimming of the ship. 

The selected alternatives show partly improved performances regarding the oil 
outflow, compared to the reference ship, which is actually in this respect a very 
good double hull representative, disposing side hull and double bottom clearances 
in excess of the MARPOL rules marginal values by 25%. This result is considered 
significant, having in mind that the regulation MARPOL 73/78 Annex 1/26 (for- 
merly Regulation 24) related to the maximum length of cargo tanks is not satisfied 
by the proposed alternatives. Consequently, it is suggested that an actualization of 
this rule could be considered. Moreover, the current optimisation method has been 
found effective to systematically assess and to improve the oil outflow performances 
of a design, generating technically and economically viable alternatives. 


6.2.8 Economic Impact Study 


Some proposed alternative designs dispose increased oil carrying capability; there- 
fore from the point of view of yearly transport work and income they are clearly 
superior to existing AFRAMAX double hull designs, thus attractive to the indus- 
try. A simplified economic assessment model, which is based on the transport cost 
per tonne of oil carried, has been applied and results thereof shown in Appendix A, 
Table 6.9. Note that in this assessment, a roundtrip voyage of 8,000 sm at a service 
speed of 15 knots has been assumed. 

Despite an expected increased building (first investment) cost, the alternative 
with longer cargo-block, (Long310) design shows a decrease of unit transport cost 
by 3.7% (the Long 310-01 even by 6.7%!). 

The same design proves superior to the basis ship with respect to its environmen- 
tal impact (reduced oil outflow index E according to MARPOL relevant regulation). 
Another interesting result of the economic impact study is that that the developed 
zero outflow design (zero spill tanker) is associated with a unit transport cost of 
about 2.7 times higher than that of the basis ship. 


6.2.9 Environmental Impact Study 


Probabilistic oil outflow calculations were carried out for side and bottom damages 
to determine mean oil outflow values, assuming damages with Loss of Watertight 
Integrity (LOWI). Zero-oil outflow and extreme oil outflow values were also calcu- 
lated in the process, assuming simplified cargo block internal details. 

The likely amount of yearly oil outflow due to collision and grounding accidents 
was estimated independently on the basis of historical accidental data for Double 
Hull tankers (Papanikolaou et al. 2006); results for the environmental impact of the 
new designs, compared to the basis ship, appear also very promising. It should be 
however noted, that the number of double hull tanker accidents (post 1990 period) 
leading to pollution is very limited to allow firm statistical conclusions about the 
future and the there upon based assessment of the present designs. Other Hazard 
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categories, besides those leading to LOWI, were not considered at this stage of 
the study. 

The performance comparison shows that design alternative 14/7 and Long310 are 
competitive to reference vessel in terms of environmental impact in case of collision 
or grounding accident, Appendix A, Table 6.8. 


6.2.10 Further Investigations 


Besides the further elaboration of the presented risk-based design concept and its 
application to any size of tanker, some further promising and most challenging items 
relevant to innovative tanker designs and increased safety are addressed below. 


a) Main Dimensions and Hull Form: The present optimization study does not in- 
clude considerations for the possible change of main dimensions and hull form 
at given deadweight capacity and speed. This is however a straightforward option 
within the introduced multi-objective optimization method by adding in the ob- 
jectives the minimization of resistance and powering, along with considerations 
of optimal trim. The latter is particularly of importance for ballast operating con- 
ditions. 

b) Structural design: No structural design aspects were introduced in the present op- 
timisation study. This can be however also introduced as an additional feature of 
the presented holistic optimisation approach. For this, a parametric structural de- 
sign model referring to the main structural elements needs to be developed and 
be introduced in the design parameters, whereas longitudinal strength require- 
ments may be introduced as constraint. This may be facilitated by interfacing the 
present optimisation procedure with known structural design software tools of 
major classification societies. The objective will be herein (in addition) the min- 
imization of the structural weight. Also, aspects of corrosion and maintenance in 
relation to cargo and ballast spaces and related areas may be introduced in the 
objectives, along with the handling of ballast water. 

c) Further Safety issues: Some further safety relevant issues may be considered 
when developing safer and more effective tanker designs. 


e Diesel electric propulsion: A diesel-electric powered propulsion system en- 
ables the possibility of installing two separate engine rooms providing higher 
redundancy as well as reduces engine room spaces. Installing also a POD 
propulsion system will enhance manoeuvrability and reduce port time with- 
out need for external tug assistance. It will also help at places of refuge for 
ships in need of assistance, as the tanker will be self sufficient for most of the 
small to medium size incidents even if she is left with a single engine room 
functioning. 

e Twin screw propulsion: Twin screw propulsion for tankers is also a rel- 
atively simple but effective design feature that will significantly enhance 
the manoeuvrability and overall safety of tankers. This appears to be also 
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cost-effective, as shown in conducted preliminary Formal Safety Assessment 
studies (Dewanney 2008). 

e Accommodation location: The possibility of locating the accommodation 
space and the deckhouse near the forepeak would improve watch keeping, and 
overall control of the vessel operations. Independently, a separated accommo- 
dation block from the control rooms, pump rooms and the bridge structure 
would also be possible, and would further reduce risk to crew life due to fire 
and explosion, and would help achieving zero-fatality rate. 


6.2.11 Conclusions 


An optimization of an AFRAMAX tanker with respect to the cargo block size and 
configuration has been carried out to arrive at the best design in terms of oil outflow 
performance whilst keeping the carrying capacity at least the same, but at best even 
increasing it. 

The best oil outflow performance was obtained for the basic double hull config- 
uration (Model 1) without compromising any economical competitiveness as mea- 
sured here in terms of carrying capacity, cargo and ballast tanks volumes and sur- 
face areas. 

Raised double bottom height for the forward section of the cargo block provides 
significant advantage in terms of reducing mean oil outflow as well as increasing 
zero oil outflow probability for mainly bottom damages. The same actually indi- 
rectly results as an effective Risk Control Option for a reduced length of the tanks 
in the forward cargo block section. 

Design alternative 141 attains better overall oil outflow index (0.971), in com- 
parison to reference vessel (1.00). Design alternative Long310 also attains better 
overall oil outflow index (0.986). Therefore these two design alternatives can be 
considered for further elaboration and development, Appendix A, Table 6.8. 

Considering that these designs were developed by a risk-based procedure, chal- 
lenging existing MARPOL rules, the route to acceptance by relevant authorities will 
be an evaluation of the proposed designs on the basis of the employed risk model 
which enables a direct comparison of a reference MARPOL design with the pro- 
posed alternative designs in terms of risk to environment, risk to property and risk 
to human life. The complete risk model and its evaluation could actually include 
all types of accidents, like non-accidental structural failure, collision, grounding, 
contact, fire and explosion. Furthermore, within the introduced holistic ship design 
optimisation procedure, further design aspects and objectives may be introduced, 
like optimization of structural design for least weight and maintenance effort, as 
well as of hull form for least powering. 

Eventually, resulting designs should prove to have a reduced oil outflow poten- 
tial in comparison to the reference design, whereas elements of the risk related to 
property and human life should also be reduced, at comparable or even increased 
efficiency and economic performance. 
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Appendix 


Table 6.7 Pareto Optimal design alternatives 


ID 0* 141 10 Long310 Long20 
Canstity mt 104630.7 106642.6 101843.9 111516.2 110,319.8 
m 122375.1 124727.9 119115.7 130428.3 129,028.9 
aft limit -73.02 —-73.02 -73.02 — 88.14 — 88.14 
fwd limit 108.42 108.42 108.42 108.42 108.42 
Layout type 0 0 0 0 0 
Long bh m 0 0 0 0 0 
dbh m 2.5 4 4.5 4.5 4.5 
sw m 25 2.1 2.5 23 2.5 
Length m 0.167 0.1 0.167 0.15 0.15 
Centre 1 1 1 1 1 
Side 0 0 0 0 0 
dbh m 2:5 4 4.5 4.5 4.5 
sw m 2.5 2.1 2.5 2:3 2:5 
Length m 0.167 0.15 0.167 0.15 0.15 
Center 1 1 1 1 1 
Side 0 0 0 0 0 
dbh m 2.5 35 4 4 4 
sw m 2.5 21 2.5 2.3 2.5 
Length m 0.167 0.15 0.167 0.15 0.15 
Centre 1 1 1 1 1 
Side 0 0 0 0 0 
dbh m 2.5 3 3.5 Ee) 3.5 
sw m 25 21 2.5 2:33 2:5 
Length m 0.167 0.25 0.167 0.15 0.15 
Centre 1 1 1 1 1 
Side 0 0 0 0 0 
dbh m 2.5 2.1 2 2 2 
sw m 25 2.1 2.5 23 2.5 
Length m 0.167 0.25 0.167 0.2 0.2 
Centre 1 1 1 1 1 
Side 0 0 0 0 0 
dbh m 2.5 2.1 2 2 2 
sw m 2.5 2.1 2:5 2.3 2.5 
Length m 0.167 0.1 0.167 0.2 0.2 
Centre 1 1 1 1 1 
Side 0 0 0 0 0 
Tank top raised m 0 1.90 2.50 2.50 2.50 
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Table 6.8 Performance comparison of the Pareto-optimal alternative designs 
ID 0 141 10 Long310 Long20 
Capacity mt 104630.7 | 106642.6 | 101843.9 111516.2 110,319.8 
mn 122375.1 124727.9 | 119115.7 130428.3 129,028.9 
Side outflow 1.00 1.3564 1.0008 1.4425 1.2977 
Bottom outflow 1.00 0.9694 0.8120 0.8074 0.8065 
Po Side = 1.00 0.9503 1.0003 0.9092 0.9403 
Po bottom - 1.00 1.0140 1.0420 1.0359 1.0365 
Capacity - 1.00 1.0192 0.9734 1.0658 1.0544 
BW volume - 1.00 0.9427 1.0794 1.0798 1.1139 
BW area - 1.00 1.0011 L.O111 1.0724 1.0752 
Cargo volume = 1.00 1.0192 0.9734 1.0658 1.0544 
Cargo area - 1.00 1.0029 0.9827 1.0514 1.0445 
E 1.00 0.971 1.037 0.986 1.001 
Note: The values are normalised with respect to the reference vessel, IDO. 


Side outflow: 
Bottom outflow: 
Po Side: 

Po Bottom: 
Capacity: 

BW Volume: 
BW Area: 
Cargo Volume: 
Cargo Area: 


mean oil outflow due to side damage 

mean oil outflow due to bottom damage 

probability of zero oil outflow for side damage 
probability of zero oil outflow for bottom damage 

total cargo carrying capacity 

total volume of ballast water tanks within cargo block 
total surface area of ballast water tanks within cargo block 
total volume of cargo tanks within cargo block 

total surface area of cargo tanks within cargo block 


Table 6.9 Economic impact study - voyage roundtrip 8,000 sm, speed 15 knots 


ID a ae 141 Long310 Zero outflow | Long310-01 
Vessel DWT 108857 110222 115296 113864 120900 
Capital cost 
Cost, $M 65.00 66.08 66.81 65.00 68.00 
CRF at 12% 20 years 0.13 0.13 0.13 0.13 0.13 
Annualized Cost 8.70 8.85 8.94 8.70 9.10 
Non -voyage optg cost, $ M 
Manning 0.89 0.89 0.89 0.89 0.89 
Stores and Lubes 0.27 0.27 0.27 0.27 0.27 
M&R 0.58 0.58 0.58 0.58 0.58 
Insurance 
H&M 0.58 0.59 0.60 0.58 0.61 
P&I 0.09 0.09 0.09 0.09 0.09 
Admin and Other 0.23 0.23 0.23 0.23 0.23 
Voyage Cost ,$ M 
Fuel 
Fuel cons, T/d 45 45.45 46.72 46.17 48.14 
Fuel cost $/T 220 220 220 220 220 
Fuel cost 3.45 3.49 3:59 3.54 3.70 
Port Costs 0.21 0.21 0.21 0.21 0.21 
Total costs, $M 15.01 15.20 15.40 15.10 15.68 
Cargo Del' d, MT/yr 1.50 1.52 1.59 0.55 1.67 
Trans Cost, $/T 10.03 9.97 9.66 27.55 9.36 
% Difference in terms of _ 0.64% 3.72% +174.70% _ 6.65% 
transport cost 


342 Apostolos Papanikolaou 


References of Section 8 


Boulougouris E, Papanikolaou A (2006) Hull Form Optimization of a High-Speed Wave Pierc- 
ing Monohull. Proceedings of the 9th International Marine Design Conference-IMDC06, Ann 
Arbor-Michigan, May. 

Boulougouris E, Papanikolaou A (2008) Multi-objective Optimization of a Floating LNG Termi- 
nal, Journal Ocean Engineering, Elsevier, Vol. 35, pp 787-811. 

National Research Council (1991) Tanker Spill Prevention by Design. Committee on Tanker Vessel 
Design, Washington D.C. 

Dewanney J (2008) The Argument for Twin Screw Tankers. Journal of Maritime Affairs, Vol. 7, 
No. 1, April. 

IMO (2003) Revised Interim Guidelines for Approval of Alternative Methods of Design and Con- 
struction of Oil Tankers Under Regulation 13F(5) of Annex I of MAPROL 73/78. Resolution 
MEPC.110(49), adopted on 18 July 

IMO (2005) Considerations and Adoption of Amendments to Mandatory Instruments. MSC80/3/5, 
21 January. 

Moore C (2006) Integrated Methodology for Survivability and Oil Outflow Assessment. POP&C, 
Deliverable 3.4 — Doc. ID Code: 3-40-RD-2006-14-01-0, EU Project, 6th Framework Pro- 
gramme, Contract No TST3-CT-2004-506193, 2004—2007. 

Murphy R D, Sabat D J, Taylor R J (1965) Least Cost Ship Characteristics by Computer Tech- 
niques. Journal Marine Technology, Vol. 2, No. 2, April. 

Nowacki H, Brusis F, Swift P M (1970) Tanker Preliminary Design — An Optimization Problem 
with Constraints. Transactions of SNAME, Vol. 78. 

Papanikolaou A, Eliopoulou E, Mikelis N (2006) Impact of Hull Design on Tanker Pollution. 
Proceedings of the 9th International Marine Design Conference, Ann Arbor, Michigan. 

Papanikolaou A, Kaklis P, Koskinas C, Spanos D (1996) Hydrodynamic Optimization of Fast Dis- 
placement Catamarans. Proceedings of the 21st International Symposium on Naval Hydrody- 
namics, ONR’ 96, Trondheim, June. 

Papanikolaou A (2008) Holistic Ship Design Optimization: Risk-Based Optimization of Tanker 
Design. Proceedings of the Colloquium on “Tradition und Zukunft des Schiffsentwurfs in 
Berlin, Horst Nowacki 75 Jahre”, 15 February. 

POP&C (2004) Pollution Prevention and Control. EU Project, 6th Framework Programme, Con- 
tract No TST3-CT-2004-506193, 2004-2007. 

SAFEDOR (2005) Integrated Project on Design, Operation and Regulation for Safety, EU-Funded 
Project, Contract TIP4-CT-2005-5 16278, www.safedor.org. 

Tuzcu C (2004) Survivability Factor. POP&C, Deliverable 3.3 — Document ID Code: 3-33-RD- 
2005-02-01-3, EU Project, 6th Framework Programme, Contract No TST3-CT-2004-506193, 
2004-2007. 

Vassalos D (2007) Risk-Based Design: Passenger Ships. Proceedings of the SAFEDOR Midterm 
Conference, Brussels, May. 


6 Applications 343 
6.3 Fast Full Displacement Ferry 


Andrzej Jasionowski and Esa Péylié 


6.3.1 Introduction 


Provision of safety in a ship design process has been based to date on the compliance 
with a set 0 prescriptive regulations, Jasionowski et al. (2006a, b, c). Although alter- 
native means of compliance with safety standards is permitted in the SOLAS rules 
in principle, the process of developing such alternatives and performing the neces- 
sary calculus has never been elaborated or agreed, e.g. with regard to fire related 
loss scenarios, and was excessively laborious. Thus, the eventual approval by the 
authorities of alternative means has never been predictable. The project SAFEDOR 
set to progress this status quo by developing transparent risk modeling techniques 
as well as by bringing about their common acceptance. 

The present study has advanced one main element of such methodology and 
demonstrated its merits. Its primary objective was to increase payload of a fast dis- 
placement ferry by more efficient utilization of space, but which solution could not 
be readily achieved without compromising safety regulations. 


6.3.2 Design Concept 


A ship representative of the current market trends was chosen as a starting basis of 
the design process, Poylid E (2006). The state of the art concept, hereafter referred 
to as Ver A, has length overall of 200m, speed of 27 knots, passenger capacity 
of 2,200 and some 4,000 car-lane meters of payload space. The vessel has typical 
machinery arrangement of two medium speed diesel engines driving two shaft lines 
through two reduction gears. Electric energy is delivered by three diesel generator 
sets and two shaft generators. 

According to the ShipPax® database there are 53 comparable vessels with pas- 
senger capacity of over 400 persons, with speed of over 25 knots and overall length 
of about 180m. The first 4 fast full displacement ferries were built in late 1970s, 
in 1980 only two ships were delivered, in 1990s 18 new builds were delivered, and 
in years 2000-2005, 33 fast full displacement ferries entered trade. There is a clear 
market demand for such concept, with new operators starting the fast-ferry based 
trade, e.g. Color Line, Viking Line, etc. 

The key design principle conceived as best responding to the objective of increas- 
ing payload has been layout referred to as “onion”, as shown in Fig. 6.26 below. 

Additionally, alternative arrangement of upper passenger decks as well as means 
of ship evacuation without life boats has been considered. As was found out dur- 
ing early design iterations, these design choices would compromise the following 
regulations: 
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Fig. 6.26 A sketch of the concept designs, (a) reference vessel Ver A, Jeff, and (b) “onion” 
arrangement, right 


1. SOLAS II-1, MSC Resolution 216 (82), Regulation 6.1 on the attained index of 
subdivision. 

2. SOLAS I-2, Regulation 9.2.2.1.2 on fire zones. 

3. SOLAS III, Regulation 21.1.2.1 on provision of life boats. 


Without RBD paradigm, whereby safety provision is based on managing risk, the 
above choices could not be considered further. The question obviously remained on 
how to demonstrate adequate safety standard of this rule-breaking design? 


6.3.3 Safety Assessment 


Safety can be considered in engineering as a “state of acceptable risk”, Jasionowski 
et al. (2006a), which notion is fully compatible with the notion of SOLAS rules, 
whereby measurable and thus verifiable regulations must be complied with so that 
“risk” is acceptable, even though “risk” itself is unknown. A case when rules are not 
met has traditionally implied that risk is no longer acceptable to verifying bodies 
such as Class Societies or Administrations. 

However, risk is neither disclosed explicitly in SOLAS rules, nor is it considered 
systematically, which is the core reason for the risk-based approach; it can prove 
advantageous in that risk posed by a design, when disclosed by a systematically 
constructed model, might prove still acceptable despite lack of compliance with 
deterministic regulations, which, in terms of risk R, could be expressed as follows: 
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Rdesign S Racceptable (6.1) 


The key challenge is of course the mentioned explicit disclosure of the risk. As 
a first step in response to this challenge the risk must be defined. It is proposed 
that the risk is understood as a “chance of a loss”, whereby the “chance” is quan- 
tified by means of various statistics of the loss, and “the loss” is measured by an 
integer number of fatalities, N (no injury of any type is considered), in case of of- 
fering a route for demonstration of a safety alternative to regulations for the pre- 
vention of loss of life SOLAS. Also, at this stage no explicitly defined acceptable 
risk Racceptable 18 available and, therefore, a traditional approach has considered it 
sufficient to demonstrate that a new design would not give rise to higher risk than 
risk posed by a comparative and rules-compliant alternative. In this case the safety 
objective is to demonstrate that: 


Raesign < Ryera (6.2) 


To re-iterate, it is obviously implicit that Rye,a is acceptable, since Ver A does 
comply with safety regulations, which are considered acceptable by all verifying 
bodies and thus society. 

The next step is the exact and verifiable quantification of risk R. Here the risk has 
been quantified by an “expected number of fatalities” which can occur, should an 
accident of collision and flooding take place, as shown below. 


Nmax Nmax 
R= >i fren) = > vi) (6.3) 
i=1 i=1 
Nmax 
Fy (N) = > frw (i) (6.4) 
i=N 


Where: Fy (N): cumulative distribution of frequency for occurrence of N or more 
number of fatalities per ship per year, known as an “F-N curve” Nmax is the total 
number of persons considered (e.g. number of crew, or number of passengers, or 
both, onboard the ship), and fry (N) is the frequency of occurrence of exactly N 
number of fatalities per ship per year, given by Eq. (6.5). 


Mhz 


fry (N) = ¥ fruz (hzj)- pyynz (N hz; ) (6.5) 
j=1 


j= 


Where nz is the total number of loss scenarios considered as “exhaustively” 
contributing to risk to life, and hz; represents an event of the occurrence of a chain 
of events HZ, (a loss scenario), identifiable by any of the following principal hazards 
(Table 6.10): 

Furthermore, fr#z (hz) is the frequency of occurrence of a scenario HZ = hz; 
per ship per year, and pyyz (N |hz 7) is the marginal probability of occurrence of 
exactly N fatalities, given loss scenario hz; occurred. The nature of the Eq. (6.5) 
is what allows for straightforward yet consistent and arbitrarily comprehensive 
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Table 6.10 Principal hazards 


J Principal hazards, hz; Average historical __fre- 
quency of its occurrence, 
frig (hz;) 

1 Collision and flooding 2.58E-03 Vanem et al. (2004) 

2 Grounding and flooding 

3 Fire 

+ Intact Stability Loss N/A in this exercise 

5 .. etc 


accommodation for any conceivable loss scenario contributing to risk to life, and 
for which reason the risk model of Eq. (6.3) or (6.4) can be referred to as “holistic”. 

In this design exercise only one loss scenario of a ship-to-ship collision, denoted 
as HZ = hz, is considered for quantification of risk to life. The frequency of occur- 
rence of this loss scenario, fryz (Az1), in this discussion will be based on historical 
data, according to which such scenario takes place 2.58E-03 times per RoPax ship 
per year Vanem et al. (2004). 

Finally, the model for assigning of marginal probability mass distribution pyj77z 
(N |hz ) for a number of fatalities N that can occur as a result of scenario of flooding 
due to a collision and subsequent loss of stability, z;, can be presented in a numer- 
ically disclosed form, Jasionowski et al. (2006a, b, c), Jasionowski et al. (2007) as 


follows: 
3 "flood NHs 


PN\|HZ (N |hz1 ) =} by SY wis Pj ek Ci,j.x (N) (6.6) 
i 7 k 


The terms w; and p; are the probability mass functions of the 3 specific loading 
conditions and njo9q number of flooding extents, respectively, calculated according 
to the harmonized probabilistic rules for ship subdivision, MSC 216 (82). The term 
e; is the probability mass function given by Eq. (6.7), where k denotes a succes- 
sive eave ouinene condition (sign. wave height) Hs;,, where 0 < Hs, < 4m, Hs, = 
k- 4- ny,. 


0.3093 if Hs, =0 
Cr = & 1.2. @ ret (0.16-1.2-H5)) , (4-nq!) if Hy >0 (6.7) 
fail (N) Ot fait (N 
Ci,j.k(N) = (-10 (€ij.x) °(Eijn) © ) ei) (6.8) 
Hs, = Fi Serie (83) 
Ej, j,k =1-0 (6.9) 
O; (ASerit (sij)) 


6; (Heri) = 0.039 - Heri +0.049 (6.10) 
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‘ if s < 0.3093 
Ascrit (8) = 4 0.16 —In(—In(s)) Fees (6.11) 
12 


Equation (6.8) associates the time it takes the ship to capsize with the number of 
persons that can loose their life, should the ship capsize within this time, through 
the following relations. 


Ot fait (N) = trait (N) — trait (N — 1) (6.12) 
trait (N) = Npgiy (t) (6.13) 
Nfail (t) = Nmax — Nevac (t) (6.14) 


Where the term Neyac (t) is the number of passengers evacuated within time f, 
referred to as an “evacuation completion curve”, see Fig. 6.27 below. 

Since no readily available tools to model the whole process of evacuation were 
available, the relation Ne,ac (t) was considered in terms of its two main elements, 
namely the mustering (assembly at muster stations) and abandonment (use of life 
boats or MES), through the IMO principle shown in Fig. 6.28 below. 

The process of assembly at muster stations is affected by the geometry of passen- 
ger spaces, and hence the commonly used method of its assessment has been based 
on numerical Monte-Carlo simulations, such as shown in the following Fig. 6.29 for 
two basic versions of accommodation spaces considered. 

The result of such a simulation is the relation between the number of persons 
reaching muster stations and the time, see Fig. 6.30. 

The speed of assembling Nassembley (t) will be affected by the angle of heel, and in 
this project this was accounted for through a speed reduction relation with an angle 
of equilibrium in damaged condition as follows. 


t ( Nassambieyin=taae ) 


t ( Nisembieso ) = 7 (0) (6.15) 
e— e35 
= 6.16 
(0) =| (6.16) 
Nmax 
Nevac ) 
i Nyait (0) 
Fig. 6.27 Evacuation com- is 


: t, 
pletion curve cap 
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Total Assembly Time (T,) 


(Individual Response Time + Individual Travel Time + Safety Margin) 


| 
Embarkation & Launching (E+L) 
(30 min - SOLAS I11/21.1.4) 


Calculated Total Evacuation Time = T, + 2/3(E+L) < [n] 


Maximum allowable time Evacuation Time [n] minutes 
(60 mins MVZ <= 3/ 80 mins MVZ > 3) 


0 Evacuation Time 


Fig. 6.28 Recommendation on the abandoning process assessment, 30 min, SOLAS III/21.1.4 


Finally, the abandoning is considered to commence 10 min prior to last person 
arriving at muster stations for each damage case, see Fig. 6.28, and take in total 30 
minutes in case of use of life boats, as suggested by SOLAS III/21.1.4, see Figs. 6.31 
and 6.32 below. 

When an MES system is considered, it is assumed that it takes on average 26 
seconds per person per shoot to abandon the ship, see Figs. 6.33 and 6.34. 


6.3.4 Design Studies 


Conducted design studies entailed a number of iterations with subsequent assess- 
ment of risk as well as impact on environment and economic performance of each 
of the design variants. Design iterations were made through brain-storming sessions 
among the design team members, leading to 10 alternatives, as summarized in the 
following Tables 6.11 and 6.12 and Figs. 6.35 and 6.36. 


6.3.5 Discussion of Results 


As can be seen from Fig. 6.35, provision of a MES system only for passenger aban- 
donment on the basis ship, Ver A, leads to about 4% increase in risk to life. This re- 
sults from the fact that abandonment through shoots assumed in this study is slower, 
see Fig. 6.34. Provision of no LSA for the ship increases risk by 11%. All other 
design iterations E, E+ (increased GM), J and K seem to lead to risk to life higher 
than on the basis design Ver A, this despite the fact that these solutions provide 
with better protection of ship vital systems in way of the machinery spaces (some 
30 or 55% lower probability of systems loss after collision in case of implement- 
ing longitudinal bulkhead at B/10 or B/5, respectively), see Fig. 6.37, as well as a 
better superstructure arrangement allowing for swifter assembly at muster stations, 
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Fig. 6.31 Relationship between time and the complement of number of persons assembling 
in muster stations and eventually abandoning the vessel by life boats Negi (t) = Nmax — 
Nassembley\p (t). Case of three heel angles assumed as attained in equilibrium after flooding. Aban- 
donment is assumed to always take 30 min, according to IMO guidelines 
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Fig. 6.32 Inverse relationship between the number of persons abandoning the vessel by life boats 
and the time, tfait (N) = Neait (t). Case of four heel angles of 0, 10, 20 and 30°, assumed as attained 
in equilibrium after flooding 
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Fig. 6.33 Experimental data on boarding a shoot and descend within the shoot, with average aban- 
donment rate of 26s per person per shoot 


see Fig. 6.30. Simply, there is higher number of extensive damage cases, where the 
vessel is lost fast with few or no passengers capable of abandoning the ship. 

The high risk to life on the design solution “Ver E blister 1 row” seemed a sur- 
prise initially; however upon inspection of a number of time-domain simulations 
it became clear that the buoyancy was provided too high, as by the time heeling 
reached some 20-30°, i.e. where the buoyant blisters become effective, the flood- 
ing of car deck and upper spaces was too extensive and thus the vessel would still 
capsize. Thus, the solution “Ver E blister 2 row” was conceived, adding one more 
row of inflatable buoyancy near the deep draft line. The effect has surpassed the 
expectation, as the risk to life has been reduced by some 90% in comparison to 
Ver A. 


100 


80 4 —~-|life boats 


70 4 — MES 


time [min] 
a 
ro) 
4 


0 500 2500 


Number of persons still onboard 


Fig. 6.34 Inverse relationship between the number of persons abandoning the vessel by life boats 
or MES, and the time, tai (N) = Neait (t). Case of up-right equilibrium after flooding. The 2298 


passengers will abandon the vessel in about 83 min through 6 MES stations, with 2 shoots each 
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Table 6.11 Description of study cases. Notation: (1.boats — life boats considered, no.LSA — no life 


saving appliances considered) 


A (digits in blue 
color correspond to} 


Study Case cases with 


Ship version and LSA 


Probability of ship capsizing 
within 3 h after events of 
collision and flooding 


Risk (PLL) Expected value of the 

number of fatalities per ship per 

year, conditional on occurrence 
of collision and flooding loss 


inflatable blisters) scenario 


Ver A (I.boats) 0.8082 


Ver A (MES) 0.8082 


Ver A (no.LSA) 0.8082 


Ver E (I.boats) 0.7488 


Ver E+ (I.boats) 0.8033 


Ver E blister 1 row (I.boats) 0.7488 (0.7754) 


Ver E blister 2 rows (I.boats) 0.7488 (0.9527) 


Ver E blister 2 rows (no.LSA) 0.7488 (0.9527) 


Ver J (I.boats) 0.7750 


Ver K (I.boats) 0.7965 


1.boats — life boats considered, no.LSA — no life saving appliances considered. 


It became clear that such solution for the provision of survivability, based on in- 
flatable buoyancy blisters, can be extremely effective, to the extent, that even when 
no LSA are provided, the risk remains extremely low. Obviously since the size and 
location of these blisters impacts upon the risk so much, there is a lot of room for op- 
timisation of this arrangement. Note, however, that there is room for improvements 
of solutions based on the “onion structure” only. 

Since this project has only concentrated on the design of ship internal arrange- 
ment for better utilisation of the space, the environmental impact has been assessed 
on the bases of annual savings in CO, emissions which would be achieved through 
the increased ratio of (cargo carried)/(energy expenditure). The results are shown 
in Fig. 6.38 below. The increased ratio of payload to propulsive power, allows for 
reduction of annual CO2 emissions by some 8% or more. 


Table 6.12 Description of economic performance of various design alternatives Mammes (2006) 


Amortisation time for addi- 
tional investment and opera- 
tional costs 


Net annual earning capacity 
increase w.r.t. basis design 


Annual earning capacity in- 
crease w.r.t. basis design 


E 13,9% E 1,1 years E 6,8% 
EE 15,9% EE 0,6 years EE 6.8% 
E+ blister 13,9% E + blister* N/A E-+ blister* 6.8% 
EE+ blister 15,9% EE+ blister* N/A EE+blister* 6.8*% 
J 12,8% J 1,4 years J 6,4% 
JJ 14,4% JJ 0,8 years JJ 5.7% 
K 13% K 1,3 years K 7.0% 
KK 14,5% KK 0,7 years KK 5.8% 


* note that the cost of installation and maintenance of the inflatable blisters is unknown at this 
stage, and hence has not been accounted for in this study. 
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Fig. 6.35 The risk to life due to loss scenario of “collision MN flooding” for the series of ship design 
alternatives considered. The impact of inflatable buoyancy, Ver E2B, is immense, with over 90% 
risk reduction in comparison to the basis Ver A. Note the level of “acceptable risk”, referred to in 
Eq. (6.2) 
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Fig. 6.36 Economic performance as a function of risk for design variations considered. Note the 
level of “acceptable risk”, referred to in Eq. (6.2) 


The proposed concept of an onion structure and changed superstructure allows 
for increase of the number of passengers up to 2,298 and the payload to between 
4,300-4,800 car lane meters, i.e. the payload increases by 8—20%, respectively, 
though the 20% car lane payload increase cannot be realized due to limitation on 
number of persons on board, and thus trailer-based usage is considered. 
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Fig. 6.37 Probability distribution for penetration depth 
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Fig. 6.38 Annual savings in CO2 emissions with respect to the basis vessel 
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The period for payback on additional investments above those envisaged for the 
basis ship, of between 0.6 to 1.4 years has been estimated for various alternatives 
considered. 

In terms of feasibility of the solutions, it is clear that the watertight arrangement 
is feasible, as it is simply a variation on the long-lower hold concept. The provision 
of inflatable buoyancy is, however, not yet established. An airbag installed for im- 
proved protection from deceleration impact seems a standard feature of nearly every 
car on the market today. Hence it is considered feasible that similar mechanism for 
stability provision, triggered by a sensor of heel, could in future effectively protect 
ships from capsizing. 


6.3.6 Further Work 


Further work would involve inclusion of more loss scenarios from Table 6.10, such 
as grounding, fire, intact stability and others. Each of these implies development of 
appropriate models for predictions of the occurrence of loss (in case of e.g. loss of 
life the task involves development of models for both the frequency of occurrence of 
each of these scenarios frzz as well as distribution of the loss pyyz ). More com- 
prehensive models should be considered, whereby design and operational variables 
such as e.g. structural arrangement, abandoning systems, crew performance, bridge 
systems, impact of systems availability see Fig. 6.39 and Eq. (6.17), or the whole 
organization of rescue operations are all included. The risk or economic modeling 
should allow for flexible extensions for bespoke solutions, such as the “blisters” 
considered in this study, this would imply that an advanced and dedicated computer 
aided design system needs to be developed, allowing for interaction at any level of 
detail and optimization. 

Moreover, proper quantification of uncertainties in modeling should be consid- 


ered. 
-_ t fail (N) 
=p (Isa_systems_fail |damage; ) 


trail; (N) (6.17) 

Last but not least, the professional community and authorities?! should develop 
explicit numerals for the acceptable risk, so that any design can be developed with- 
out reference to existing concepts. 


Fig. 6.39 Assessment of systems availability could be included in risk modelling 
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6.3.7 Conclusions 


This study has demonstrated that risk-based design of RoPax ships is possible and 
that it can lead to very effective and safe design solutions. A series of design solu- 
tions, inconceivable when the creativity space is restrained by the prescriptive safety 
codes and regulations, but enabled through the new philosophy of risk-based design, 
have been explored. A design which is substantially more attractive commercially, 
more environment-friendly and yet is dramatically less risky with respect to poten- 
tial loss of life, has been developed. 

It seems that the key for risk-based-design to become reality is the disposal of a 
robust risk model, which is validated and accepted by the authorities. 

Elements of the concept of a holistic view of safety have been explored through 
implementation of a comprehensive model of risk. It was found that despite more 
efficient superstructure arrangement in terms of the evacuability, the design as a 
“whole” was more risky. 
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stress on the ship’s hull as a result of overloading. Thus, limitations on the draught 
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limits are given in the form of freeboards, which constitute, besides external weath- 
ertight and watertight integrity, the main objective of this Convention. As other 
conventions, it was continually updated at IMO by amendments through the years 
(http://www.imo.org/Conventions/). 


Acronyms and Glossary 363 


STCW Convention 


The International Convention on Standards of Training, Certification and Watch- 
keeping for Seafarers (STCW), 1978, as amended, sets qualification standards for 
masters, officers and watch personnel on seagoing merchant ships. STCW was 
adopted in 1978 by conference at the International Maritime Organization (IMO) in 
London, and entered into force in 1984. The Convention was significantly amended 
in 1995. 


Authors Biography 


Carlos Guedes Soares is Professor and Head of the Naval 
Architecture and Marine Engineering Department and the Cen- 
tre for Marine Technology and Engineering of Instituto Superior 
Técnico, Lisbon. He has post-graduate degrees from the MIT, the 
NTNU and the TU Lisbon and about 30 years experience in teach- 
ing and research work in the fields of structural analysis and de- 
sign, of dynamics and hydrodynamics and on probabilistic mod- 
elling for application in risk and reliability analysis. He has been 
involved in about 50 European projects, co-ordinating 9 of them, and also co- 
ordinated about 10 national projects. He has published about 650 papers in interna- 
tional journals, books and conferences, is co-editor of scientific journals and mem- 
ber of several international organisations. 


Andrzej Jasionowski graduated from the Technical University 
of Gdansk (MEng, 1997), and University of Strathclyde (PhD, 
2002). He is engaged as Technical Manager of the Ship Stabil- 
ity Research Centre, Universities of Glasgow and Strathclyde, and 
Director of Safety At Sea Ltd, Glasgow, Scotland. His main inter- 
ests comprise ship hydrodynamics, damaged ship dynamics, sta- 
bility, risk assessment, inductive inference, plausible reasoning, 
modelling uncertainty, numerical algorithms development, philos- 
ophy of safety. He is author/co-author of 35 journal and conference papers, 50 other 
contract reports. 


Jorgen Juncher Jensen is Professor of Marine Engineering at 
the Department of Mechanical Engineering, Section of Coastal 
Maritime and Structural Engineering, DTU, where he is leading a 
research group dealing with wave induced stochastic load and re- 
sponse processes for marine structures. He has been at DTU since 
1973 and has received various awards (e.g. Bronze Medal from 
Royal Society of Naval Architects, London, Gold Medal from the 


366 Authors Biography 


Alexander Foss Foundation and the Statoil Prize). He has been involved in several 
EU sponsored project as well as national projects and has authorized about 150 
papers. 


Jeppe Skovbakke Juhl, Special advisor, holds a position of naval 
architect at the Danish Maritime Authority with responsibility for 
implementation of international rules and regulations into Dan- 
ish maritime legislation. For the last couples of years, he has rep- 
resented the Danish Maritime Authority in several national and 
international forums, such as IMO and EU, and has furthermore 
been appointed as technical representative to projects under the 
auspices of the Nordic Council of Ministers. His key competencies are ship stability 
and maritime risk assessments. Moreover he has participated in several EU-projects 
and other international work. 


Mr. Dag McGeorge qualified as a naval architect from NTNU in 
Norway in 1989 and now holds the position of Principal Engineer 
at Det Norske Veritas. He has 15 years of working experience in 
project management, research and development, innovation and 
consultancy mainly related to maritime, naval and offshore activi- 
ties with focus on the use of advanced and lightweight materials in 
load-bearing structural applications. He was project manager and 
technical coordinator of a large collaborative European R&D project on composites 
in superstructures of naval ships (EUCLID RTP3.21) and is now leading SAFE- 
DOR’s subproject on risk based design of composite superstructures. 


Apostolos D. Papanikolaou studied Naval Architecture & Marine 
Engineering at the Technical University of Berlin, where he also 
received his Dr.-Ing. and Habilitation degrees. He is Professor of 
Ship Design in the School of Naval Architecture and Marine Engi- 
neering of the National Technical University of Athens and Direc- 
tor of the Ship Design Laboratory. His educational, research and 
professional activities cover a broad area of Naval Architecture and Ocean Engineer- 
ing and are documented in about 400 technical publications. He was and is Principal 
Investigator of a long series of EU or nationally funded research projects regarding 
the design and optimization of conventional and unconventional ships, the hydrody- 
namic analysis and assessment of the calm water performance and the seakeeping 
behavior of ships, the stability and safety of ships and regulatory developments. 


Authors Biography 367 


Esa P6yli6 is Project Engineer in the Concept Design department 
of Deltamarin Contracting Ltd. He graduated as Naval Architect 
(B.Sc) from the Technical Institute of Turku in 1980. During the 
period 1980-1984 he worked in the steel design department and 
1984-1990 in the Project Design Department of Elomatic Oy. 
From 1990 he has been working in the Concept Design depart- 
ment of Deltamarin as Project Engineer and Project Manager of 
design of various ship types. In his 28 years in engineering, Mr Péylid has gained 
a vast experience in ship design and design project management and has become 
familiar with safety related international rules and regulations. 


Pierre C Sames holds the current position of Senior Vice Presi- 
dent Strategic Research and Development at Germanischer Lloyd. 
He is responsible for coordinating all technical research and devel- 
opment projects of GL. He is chairman of the SAFEDOR Steering 
Committee. His previous experience includes research into hydro- 
dynamic extreme loads and risk analysis. He joined GL in 1995 
after studying naval architecture in Hamburg. 


Rolf Skjong (PhD) is currently chief scientist in Det Norske Ver- 
itas Research and Innovation. He is Chairman of the International 
Association of Classification Societies (IACS) Expert Group on 
Formal Safety Assessment and Chairman of the European Safety 
and Reliability Association (ESRA) group on Safety in Marine 
Transportation. He has 25+ years of experience in risk assessment 
and reliability analysis, project planning, optimisation, rules and 
regulations, design and approval. He is a Specialist in Structural 
Reliability Analysis and Formal Safety Assessment, and is representing Norway in 
the International Maritime Organisation on risk issues. He has been member of var- 
ious national and international scientific/steering committees. As project manager 
he is/has been responsible of a large number of Strategic Research Projects and in- 
ternational joint industry projects e.g. EU projects for maritime, off-shore, process 
and aerospace industries. He has published 100+ journal and conference papers. 


Dracos Vassalos is Professor of Maritime Safety in the Depart- 
ment of Naval Architecture and Marine Engineering, a joint De- 
partment of the Universities of Glasgow and Strathclyde, and the 
Director of the Ship Stability Research Centre (SSRC), a world- 
leading centre of excellence on ship stability and safety. His motto 
is “safety enhancement through innovation”, an idea he has pur- 
sued single-mindedly in a career that spans over 30 years in 
industry and academia, promoting the use of scientific approaches in dealing with 
maritime safety. He has been instrumental in helping to create a critical mass in 


368 Authors Biography 


the research community on safety, through a series of initiatives that made SSRC 
the focus of active international collaboration. He travels the world over promoting 
maritime safety, lectures and publishes widely, with some 400 technical publica- 
tions to his credit and a string of prizes and awards, including some 100+ ma- 
jor research contracts. He served as Chair of the STAB Conferences and Work- 
shops (1996-2006), Chair of the ITTC Stability Committee in Waves (1996-2002), 
Chair of WEGEMT (the European Association of Universities in Marine Technol- 
ogy 1999-2001). Currently, Professor Vassalos is Chairman of the International 
Standing Committee of the “Design for Safety” Conference, a theme instigated and 
promulgated by SSRC. He is also a long-standing member of the UK delegation to 
IMO for ship stability. 


Index 


Abandonment studies, Evi, 55 
Acceptable risk, 11, 354 
Acceptance criteria, 189 
Acceptance criterion philosophies 
cost-effectiveness, 169 
risk acceptance criteria for ship functions, 
168 
risk balance, 169-170 
risk evaluation criteria at IMO, 168 
AENEAS, 299 
Alternative approval methods, 155 
Alternative design, 68 
approach, 71, 72 
and arrangements, 164 
process, 180 
ANSYS CFX, 264 
Approval in principle statement, 172 
Approval matrix 
categorization of technology, 182 
explanatory notes, 183 
quantified risk assessment, 183 
semi-quantitative risk assessment, 183 
Artificial neural networks (ANN), 227, 230 
ASET (Available Safe Egress Time), 57 
As Low As Reasonably Practicable (ALARP), 
115, 123, 168 
criterion, 115 
Assessment and approval of risk-based ship 
design, 170 
approval of design, 172 


Bayesian Network, 196, 215, 216 
drawback, 217 

Bayesian Network analysis, 217, 219 

Bernoulli theorem, 253 

Binary Decision Diagrams (BDDs), 206 

Bulk carrier safety, 8, 106, 108, 114, 131 

Bulkhead deck submergence and progressive 
flooding, 82 


Capsize band, 37 
CAPSIM, 260 
Casualty threshold, 84-85 
Certificates documentation, 172 
Cognitive task analysis, 222 
Collisions and groundings 
damage after collision, 226-231 
collision network, 230-231 
data used for training ANN, 227-229 
validation of neural network, 229 
factors influencing causation probability 
Bayesian network of collision model, 
224 
collision scenario, 223 
detailed collision approach, 223-224 
grounding model approach, 224-226 
human and organizational errors, 
220-221 
human error evaluation, 221—223 
reported causes, 219-220 
risk model for obtaining causation 
probability, 213-219 
Bayesian networks, 215-219 
causation probabilities, 219 
fault tree, 214 
traditional approach, 214-215 
weighing factors for headings, 219 
Compensation effect, 84 
Concept design description, drawings and 
documents, 171 
Cost of Averting a Fatality (CAF), 168 
Cost of Averting a Ton of oil Spilt (CATS), 168 
Critical wave episodes, 276, 279, 285 


Damage after collision, 226-231 
accuracy of penetration prediction, 229 
data for ships, 230 
grounding network results, 227 
illustration, 228 


369 


370 


inputs to artificial neural network, 228 
predicted penetration, 230 
Damage stability regulations, 146 
probabilistic standards of, 166 
Design alternatives 
alternatives, 141, 331-332 
principle characteristics, 332 
alternative zero spill tanker, 334-336 
Design for Safety, 9 
Designing damage tolerant ship systems, 50 
Diffraction forces, 251 
Disability Adjusted Life Years (DALYs), 
122, 137 
3D panel method, 249 


Electronic Chart Display and Information 
System (ECDIS), 112 
Environmental impacts from shipping 
activities, 139 
Environmental risk assessment, 139 
Equivalence principle, 68 
See also Alternative design 
Equivalent Fatalities, 122 
Equivalent Passenger Ship Regulations, 102 
Equivalent provisions, 163, 164 
EU-funded projects 
CRASHCOASTER, EU-funded project, 15 
DEXTREMEL, EU-funded project, 15 
FIRE EXIT, EU-funded project, 15 
HARDER, EU-funded project, 4, 15 
MEPDESIGN, EU-funded project, 15 
NEREUS, EU-funded project, 15 
POP&C, EU-funded project, 15 
ROROPROB, EU-funded project, 15 
SAFECRAFTS, EU-funded project, 15 
SAFEDOR, EU-funded project, 15 and 
others 
SAFER EURORO I, EU-funded project, 15 
SAFER EURORO II, EU-funded project, 
15 
SAFETY FIRST, EU-funded project, 15 
VRSHIPS-ROPAX2000, EU-funded 
project, 15 
Evacuability, 59, 60, 61 
Evacuability Index, 55 
in fire scenarios, 56-58 
human injury analyses, 58 
speed reduction factor, 57 
temperature at 1.5m height from floor 
level, 57 
in flooding scenarios, 55-56 
and rescue analysis, 54—55 
Evacuation completion curve, 347 
Evacuation dynamics (ED), 290-291 


Index 


Evacuation process, 54 

of passenger ships, 289 
Event tree analysis, 215 
EVI, 296 
EXODUS, 298 


Failure mode and effects analysis (FMEA), 
7, 167 
Failure probability, 189 
Fatality count, 274-275 
Fault Tree Analysis (FTA), 198, 215 
Fault tree synthesis process, 200 
Fibre reinforced plastic (FRP), 304 
Fire 
containers and cargo space 
Bayesian network representing fire in 
container, 267 
Bayesian risk model for cargo fire, 
267-270 
fire simulations, 265-267 
incident frequencies of occurrence, 270 
temperature on cargo, 265 
in containers and cargo space, 264—270 
probability distribution, 91 
risk analysis, 270-275 
main probabilities for fire QRA, 271 
passenger cabin and public space fire 
scenario, 272 
principle, 270 
soot, 274 
velocities and temperatures, 273 
Fire design scenario 
alternative design, 72, 73 
and arrangements iteration, 70 
alternative design approach, 71, 72 
non-fire scenario, 73 
prescriptive design, 74 
restaurant design parameters, 70 
Fire hazards, effect of, 69 
Fire risk model 
fire ignition model 
frequency of occurrence, 47 
overview, 45 
post-ignition models 
failure of first aid, 47, 48 
failure of insulation, 49-50 
fire dynamics modelling, 47 
fire spread into adjacent spaces, 49-50 
impact of first-aid on fire energy time 
line, 48 
injury/fatalities, SO 
standard fire time line, 49 
relative frequency of occurrence, 46 
for space, 44 


Index 


Fire risk screening, 43 
Fire safety analysis, 87-88 
escalation, 89 
incidence, 88 
risk, 89 
First Order Reliability Methods (FORM), 232, 
279, 280 
First Order Second Moment 
approaches, 235 
Flooding 
benchmark studies 
numerical and experimental levels of 
water, 259 
survival boundaries, 258, 259 
and fire, risk from, 92 
intermediate stages of, 256 
modeling ship flooding 
floodwater dynamics, 254—256 
inflow/outflow, 253-254 
progressive flooding, 256-257 
modelling damaged ship dynamics, 248 
equations of motion, 248-250 
external forces, 252 
potential forces, 250-251 
viscous forces, 251—252 
modelling sea environment, 245-247 
parameters and characteristics of numerical 
models, 246 
probability distribution, 90 
structure of damaged ship dynamics 
numerical models, 246 
Flooding design scenario 
consequence analysis, 64 
cumulative dA(risk), 66 
design iteration for collision damage, 63 
identification of critical, 66, 67 
time evolution of collision damage 
scenario, 67 
Flooding/fire evacuation models, 55 
Flooding survivability analysis, 74-75 
statutory assessment 
platform optimisation process, 76, 77 
“unguided” subdivision, 76 
vulnerability assessment 
distribution of relative contribution, 80 
example cruise vessel subdivision, 
78, 79 
particulars of example cruise vessel, 77 
typical model, 80 
Fluid dynamics methods, 255 
F-N curves, diagram, 34, 93, 345 
FN risk evaluation criteria, 128 
for passenger Ro/Ro ships, 132 


371 


Formal Safety Assessment (FSA), 8, 10, 
99, 101 
guidelines, 100 
decision parameters, 121-122 
methods, 114 
process, 115 
FORM procedure, 280 
Fractional Effective Dose (FED), 57 
FREDYN, 277 
Froude-Krylov forces, 251 
FSA for bulk carriers 
decision making, 108 
decision-making related to double side 
skin, 111-112 
individual (annual) risk per ship-type, 107 
initial studies, 106 
risk control options and decisions, 108-111 
double side skin for new bulk carriers, 
108 
forecastle for new bulk carriers, 110 
societal risk of bulk carrier and container 
vessel accidents, 107 
studies at IMO, 106-108 
Functional requirements, 118 


Genetic Algorithms (GA), 316 
GL-SIMBEL, 277 
Goal based approach, 146 
Goal-based Standards (GBS), 10, 97, 
98, 116 
working group, 191 
Goal-setting approach, 19 
Grid based techniques, 296 
Grim’s effective wave, 277 
Gross Cost of Averting a Fatality (GCAF), 133 
Grounding model approach, 224-226 
Bayesian network, 226 
collision network results, 225 
model for calculating, 225 
Group risk, 127 


HARDER EU-funded project, 4, 15 
Hazid investigation, 172 
Helicopter landing area (HLA), 104 
High level FSA, 113 
studies, 8 
HiP-HOPS, 199, 210 
components’ failure modes, classes of, 
202-203 
HUGIN, 264 
Human errors, 220 
factors, 221 
Hybrid approaches, 296-297 


372 


Impulse response function method, 251 
Indirect goal based approach, 98 
Individual risk, 123 
for crews, 126 
criteria, 124-125 
in industries and activities, 125 
Individual risk evaluation criteria, 123, 126 
Intact stability 
first-order reliability method applied wave 
loads 
design point and reliability index, 
280-281 
mean out-crossing rates and exceedance 
probabilities, 282-283 
numerical example, 283-285 
coefficients in analytical approxima- 
tions, 283 
GZ curves, 283 
parametric roll in regular wave, 283 
particulars of container ship, 283 
reliability index as function of limiting 
roll angle, 286 
roll motion of ship, 276-280 
Interactive fiction, 293 
Intergovernmental Panel on Climate Change 
(IPCC), 141 
Interim Guidelines, IMO, 7, 104 
International Association of Dry Cargo 
Shipowners (INTERCARGO), 108 
International Maritime Organization (IMO), 
2, 97 
decision-making process, 100 
evacuation analysis, 54 
goal-based standards, 117 
Maritime Safety Committee (MSC), 99 
Rule-making Process, 99 
International Monetary Fund (IMF), 136 
International Safety Management (ISM) 
code, 191 
documentation, 191 
International Ship and Port Security (ISPS) 
Code, 102 


LAMP, 277 
Large passenger vessel (case story) 
building blocks of risk-based design 
advanced evacuation simulation, 59-61 
fire risk assessment, 68-69 
flooding risk assessment, 61-62 
early implementation results 
fire safety analysis, 87-88 
flooding survivability analysis, 74-87 
safety level, 88-89 
Life Quality Index Criterion, 135 


Index 


Lightweight composite sandwich RoPax 


superstructure 
benefits of risk based design, 313 
weights and new-build costs of steel 
design, 313 
developing novel risk-based design 
acceptance criteria, 307 
base design, 306 
features of risk based design, 306-307 
risk based design process, 306-307 
superstructure modules, 305 
discussion, 313-314 
fire risk assessment 
fire simulations, 309 
full scale fire test trial, 310 
resistance test, 310, 311 
small scale fire tests, 309 
results of fire risk assessment 
estimated effect of RCOs, 312 
sandwich form of construction, 304 


Maritime and Coastguard Agency (MCA), 99 
Maritime Safety Committee (MSC), 102 
MEPDesign project, 56 
Mesoscopic modeling, 294, 298 
Methods and tools 
system failure, 197-211 
analysis phase, 206 
automated safety analysis and 
optimization tool, 209 
conversion of fault trees, 207 
example system and fragments, 204 
failure annotations, 203 
mechanically constructed fault tree, 205 
methodology, 200-201 
modeling phase, 201-203 
optimisation phase, 207-209 
synthesis of fault trees from system 
model, 201 
synthesis phase, 204-206 
tool support, 209-211 
Monte Carlo simulation — collision and 
grounding 
automation of process, 38-40 
probability distributions, 42 
sampling, 42 
set up, 41 
Multi-Criteria Decision Making (MCDM), 319 
Multi-free surface effect 
intermediate stages of flooding, 81-82 
Mustering, evacuation and rescue 
shipboard evacuation problem, 289-297 
concept of evacuability, 290 
initial conditions, 290 


Index 


macroscopic modeling, 296 

mesoscopic modeling, 294-295 

microscopic modeling, 296-297 

modeling human behaviour, 291 

modeling ship environment, 290 

multi-agent modeling, 292-294 

passenger mustering/evacuation process 
modeling, 292 

path-planning algorithm, 294 

simulation of evacuation, 291, 294 

tools for simulation and analysis of 

passenger 

AENEAS, 299 

EVI, 297-298 

EXODUS, 298-299 


Net Cost of Averting a Fatality (NCAF), 
106, 134 

Nuclear Regulatory Commission 
(NRC), 97 

Numerical methods, 257 


Observed Evidence, 269 

Occupational risk, 124 

Operator function model (OFM), task analysis, 
221 

Organisational errors, 221 


Pareto-Optimal Design Alternatives (PODAs), 
319 

Pareto optimality, 144 

Pareto-optimal set, 319 

Performance-based approach, 43 

Performance-based methods for fire 
safety, 68 

Platform optimisation process, 76, 77 

Port State Control-file/design details, 172 

Post-accident systems availability analysis, 
50-52 

Potential damping, 251 

Potential Loss of Life (PLL), 35, 109 

Probabilistic models, 235 

Probabilistic Safety Assessment (PSA), 98 

Probability of fire spread, 50 

PROBAN, 279, 281 

Process map, 171 

Progressive flooding, 256 

PROTEUS3, 40, 55, 61-62, 77, 80 


Qualitative Design Review (QRD), 270 
Quantitative Risk Analysis (QRA), 26, 270 


Radiation forces, 251 
Random choice method, 251 


373 


Risk-based Design (RBD) application 
concept of design study 
challenges, 322-323 
safety goals, 322 
design optimisation procedure, 319-320 
implemented tanker design optimisation 
procedure, 320 
design optimization case study 
implementation of optimization 
procedure, 329 
implemented optimization constraints 
and assumptions, 327 
implemented optimization objectives, 
327 
optimisation variables, 328 
parameters defining cargo tanks, 326 
pareto-optimal design alternatives, 
330-331 
resulting design alternatives, 331-336 
risk-based tanker design optimization, 
330 
search domain, 330 
search of design resultant domains, 
329-330, 
tank configuration layouts, 324 
economic impact study, 337, 341 
environmental impact study, 337-338 
holistic ship design optimization, 317-318 
innovative tanker designs and increased, 
challenges, 338-339 
overview of design problem, 323-324 
pareto optimal design alternatives, 340 
performance comparison, 341 
reference vessel, 320-322 
Regulatory framework 
decision parameters, 121-122 
discussion on FSA 
methods, 114 
open issues, 114 
process, 115 
risk acceptance criteria, 115 
work, 113 
environmental risk evaluation criteria, 
138-141 
emissions and discharges from ships, 
140 
global economic mitigation potential, 
142 
Formal Safety Assessment 
application-general, 100 
historical background, 98-99 
purpose, 99-100 
FSA, illustration of, 101 
future, 170 


374 


general procedure for establishing risk 
criteria at lower level, 147 
Goal Based Standards 
definition, 117 
framework, 117 
functional requirements, | 18—120 
goals, 117-118 
risk acceptance 
methods to justify criteria, 120-121 
risk-based approaches, 145-147 
emissions relationship, 146 
risk criteria for use, 143-145 
risk evaluation criteria, 
122-123 
Regulatory Impact Diagram (RID), 104 
Regulatory system, 98 
Reliability Index, 232-233, 280-281, 282, 
283, 285, 286 
Reliability models, 188, 208, 211 
Required Freight Rate (RFR), 317 
Resolution A.265 (VIII), 4 
Risk acceptance criteria, 3, 5, 11, 12, 84, 
101, 106, 110, 114, 115-120, 122, 
143-145, 147, 168, 175, 188, 190, 
270, 307 
for ship functions, 168 
Risk analysis 
guidelines for, 188 
of ship systems, 188 
techniques, 98 
Risk assessment 
analysis and detailed documentation, 172 
and FSA, development of 
bulk carriers, 106-112 
decision parameters, 121-122 
helicopter landing area on cruise ships 
as safety measure, 104-105 
high speed craft, 104 
ongoing FSA on electronic chart 
display and information system, 
112-113 
‘Solo Watch-keeping During Period of 
Darkness,’ 103 
Risk-based approaches, 2, 145 
alternative design 
and arrangement for fire safety, 6 
for oil tankers, 6-7 
formal safety assessment, 8 
offshore industry, 4-5 
probabilistic damage stability, 3-4 
regulatory developments, 9-10 
research activities, 9 
special craft, 7-8 
structural reliability analysis, 5—6 


Index 


Risk-based approval, 159, 175, 177 
acceptance of alternative design 
acceptance criterion philosophies, 167 
future regulations for alternative 
designs, 165 
high-speed-craft code requirements, 
167 
safety equivalent provisions, 163-164 
SOLAS II-1 related to damage stability, 
165-166 
SOLAS II-2/17 related to fire safety, 
164-165 
SOLAS 2009 replacing SOLAS 90, 
166-167 
approval flow diagram, 158, 160 
approval of ship systems, 185-190 
acceptance, 186-190 
risk-based ship system approval flow 
diagram, 187 
approval procedure, need for, 
155-157 
design envelope, 157 
flow chart, 181-182 
motivation and enabling technologies, 156 
novel approval process, 161 
operating risk-based approved ship 
documentation, 190-191 
inspection, 192 
International Safety Management Code, 
191 
owner’s inspection, 193 
present approval process, 158-159 
process, 159-163 
requirements to documentation, 179-185 
approval matrix, 182-185 
risk-based design and associated approval, 
175-178 
key steps for normal projects, 177 
key steps in risk-based design and, 178 
rules and regulations, 179-180 
stakeholders in approval process 
design and construction phase, 171-172 
operational phase, 172-175 
Risk Based Design (RBD), 59, 97 
and approval 
design framework and tools, 12-13 
elements, need for, 12 
linking, 10-11 
qualified engineers, 13 
regulatory framework, 12 
working together, 11-12 
enhanced design process, 3 
framework, 27 
inspection of, 192 


Index 


methodological approach 
ship design process, 20-25 
operation of, 190 
optimisation, 156 
owner’s inspection, 193 
philosophy, 156 
positive and negative sides to rule- 
compliance, 22 
principles, 26-28 
process, 306-307 
safety performance parameters, 21 
societal expectations and economic 
attractions, 1-2 
toolbox of engineer, 13 
variants of, 156 
Risk Based Regulation, 98 
Risk based regulatory regimes, 143, 144 
Risk-based ship system approval process, 
185, 186 
Risk Control Option (RCO), 98, 264, 305 
cost effective, 305 
implementation of, 73 
Risk conversion factors, 127 
Risk evaluation criteria, 98, 121-122 
background, 123-124, 127-128 
CAFs in use, 134 
comparison with historical data, 126-127 
cost benefit and cost effectiveness 
assessment, 132-136 
cost of averting fatalities, 133, 136 
example of disability adjusted life years 
gained, 138 
examples of criteria and comparison with 
data, 130-132 
FN curves, 130-131 
individual fatality risk, 126 
individual risk criteria, 124—126 
method, 128-130 
net cost of averting fatality criteria, 135 
purpose, 123, 127 
risk of injuries and ill health, 136-138 
third parties, 132 
Risk evaluation of ships, 9 
Risk integration 
annual frequency of occurrence, 93, 94 
probability distribution, 91, 92, 94 
Risk model, 186 
components of, 45 
Risk of design, 11 
Risk Priority Number (RPN), 198 
ROLLS, 277 
RSET (Required Safe Egress Time), 57 
Rule-challenge, 156 
Runge-Kutta method, 250 


375 


Safe return to port, 10 
decision making in flooding-related 
casualties, 87 
flooding-related 
casualty classification, 86 
functional requirements classification, 
86 
Safety assessment process, 27, 28 
previous, 101 
Safety Case Regime for ships, 143 
Safety equivalence, 3, 156 
See also Rule-challenge 
Safety goals, 28 
definition, 28 
specific technical, 29 
top-level, 28 
Safety Level Approach (SLA), 10 
Safety levels and acceptance criteria, 169 
Safety Management System (SMS), 172 
Safety-related functional requirements, 30 
Safety study, 162 
SAVANT (Systems Availability Analysis 
Tool), 51 
Self-regulatory approach, 5 
Ship Construction File (SCF), 161, 172, 191 
Ship design process 
contemporary developments, 32-34 
casualty threshold concept, 33 
IMO framework, 32 
risk-based design implementation 
(safety level), 34 
safe return to port, 32-33 
scope of work, 33 
risk-based design, 26-31 
design decision-making, 30-31 
functional requirements, 30 
high level framework, 27 
identification of critical design 
scenarios, 29 
identification of hazards, 29 
and innovation, 26 
making, 31 
safety assessment procedure, 28 
structural links of design scenarios, 30 
rules-based design, 20-25 
collision risk containment, 23 
“common sense” approach to ship 
design, 24 
design decision-making shift, 25 
design input, 21 
design solution envelopes, 25 
high-level conventional design 
process, 20 
rules vs. experience, 23 


376 


safety considerations, 21 
total risk (safety level), 34-36 
concept of “capsize band,” 37 
evacuation and rescue analysis, 54-57 
fire safety analysis, 43-50 
flooding survivability analysis, 36-42 
post-accident systems availability 
analysis, 50-54 
principal hazards, 36 
time to capsize and evacuation time, 38 
Ship functions 
risk and, 186 
systems and, 188 
Ship Stability Research Centre (SSRC), 60 
Simulating fluid dynamics method, 256 
Social force methods, 296 
Societal risk evaluation criteria, 122, 127 
acceptable level of risk, 127 
See also Individual risk evaluation criteria 
SOLAS, 144-145 
SOLAS Chapter II-2, regulation 18 
methods for fire safety, 160 
SOLAS 90 damage stability requirements, 166 
SOLAS regulations, 3 
Specific risk control option, 122 
Speed reduction factor, 56 
Stakeholders, in design and operation, 171 
State-of-the-art design methodology, 18 
Statutory requirements, 179 
Strip theory/3D panel method, 251 
Structural failure 
Ferry-Borges model, 240 


Index 


load combination, 238-241 
probabilistic modelling 
of still water induced loads, 235-236 
of strength of ship structures, 233-235 
wave induced load effects, 236-238 
reliability of accidentally damaged 
structures, 241-242 
values of load combination factors, 241 
Structural reliability methods, 5-6, 106, 
232, 233 
Subdivision of Ships, 102 
Systems dependency tree, 52, 53 


Time-invariant methods, 232 

Time to capsize, 38 
cumulative probability distribution, 84 
time-domain simulation, 83 

Top down process, 98 

Transient and intermediate flooding, 256 
numerical simulation, 81, 82 

Trial Applications, 77 


Univariate geometric distribution — collision 
cumulative marginal probability 
distribution, 40 
cumulative probability function, 39 
estimating time to capsize, 38-40 
Utility functions, 331 


World Bank (WB), 136 


Zone methods, 264 


